Arista VeloCloud Orchestrator Improper Input Validation Vulnerability Added to CISA KEV

What's on the official record

CISA added CVE-2026-93952 to the Known Exploited Vulnerabilities Catalog on 22 September 2026 (catalog version 2026.10.21). The vulnerability is an improper input validation issue (CWE-20) in Arista VeloCloud Orchestrator (VCO) On-Prem. CISA's remediation due date for federal agencies is 25 September 2026. The CVE record names no fixed version; Arista VeloCloud Orchestrator (VCO) On-Prem is affected through 5.2.3.15 and through 6.1.3.7. The catalog does not record known ransomware use.

Assessment

For a platform or AI-stack owner, the record lets you check whether any Arista VeloCloud Orchestrator On-Prem deployment in your estate runs a version at or below 5.2.3.15 or 6.1.3.7, and decide whether to isolate or patch it. The CVE record names no fixed version, so the record supports applying the vendor's mitigations per CISA's required action rather than a version upgrade. The record also lets you confirm the vendor advisory for the specific remediation steps.

For a cyber underwriter, the record lets you check whether a policyholder's estate includes Arista VeloCloud Orchestrator On-Prem at an affected version, and decide whether to require a control or price the exposure accordingly. CISA's ADP records active exploitation with automatable exploitation and total impact, which the record supports using to weigh the exposure. The catalog does not record known ransomware use, so the record does not support a ransomware-specific exclusion.

What would change this call

A named fixed version from Arista or the CVE record would change the platform owner's patch decision from mitigation-only to a version upgrade. A catalog update recording ransomware use would change the underwriter's pricing or exclusion decision.

What to check next

Confidence

Filed 25 October 2026 from the record dated 22 September 2026.

Sources

[1] Arista VeloCloud Orchestrator Improper Input Validation Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-93952

[2] CVE record CVE-2026-93952 — https://www.cve.org/CVERecord?id=CVE-2026-93952

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog