How to find Arista VeloCloud Orchestrator appliances on your network
ID: 432041df-1f5c-5dce-8a78-5c209cbce367
STIX ID: report--432041df-1f5c-5dce-8a78-5c209cbce367
Feed Name: runZero Blog
**Executive summary:** Arista disclosed a critical improper input validation vulnerability (CVE-2026-93952, CVSS 9.5) in on-premises VeloCloud Orchestrator allowing unauthenticated remote attackers with network access to the web interface and a certificate-based Edge-Orchestrator setup to access privileged internal functionality and potentially fully compromise the orchestrator; multiple release trains are affected, exploitation has been observed in the wild and the issue is listed in CISA's KEV catalog, with fixes available for some versions and mitigations recommended for others.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.