New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

A critical CVSS 10.0 vulnerability tracked as CVE-2026-93952 has been discovered in on-premises VeloCloud Orchestrator (VCO), the server responsible for managing Edge devices in VeloCloud SD-WAN deployments. Arista disclosed the flaw on September 22, 2026. The vulnerability allows a remote unauthenticated attacker to access privileged internal functions and potentially compromise the VCO host. Only orchestrators configured to authenticate their Edge devices using certificates are affected by this flaw. Active exploitation has been confirmed in the wild, making this a high-priority patching target for affected organizations. The maximum CVSS score of 10.0 underscores the severity and ease of exploitation of this vulnerability.