New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

T2Critical 65Covered by 1 source · first reported by The Hacker News at 22 Sept, 12:29 UTC

Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator (VCO), the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952, may allow a remote attacker with no login access to privilege internal functions and…

security

Sources

• T2New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based SetupsThe Hacker News22 Sept, 12:29

Vulnerabilities

• CVE-2026-93952