Source: cisa.gov
Arista VeloCloud Orchestrator (VCO) on-premises deployments contain an improper input validation vulnerability tracked as CVE-2026-93952. A remote attacker could exploit this flaw to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data it manages. The vulnerability is listed in CISA's known exploited vulnerabilities catalog and is subject to BOD 26-04 remediation requirements. Organizations running on-prem VCO deployments are urged to apply security updates as prioritized by CISA directive. Arista has published a security advisory with remediation guidance. Forensics triage requirements have also been outlined under BOD 26-04 implementation guidance.
