> TritonInfoSec News
Home / Sep 23, 2026 / Story
0
#7 The Hacker News general September 22, 2026 at 12:29 UTC

New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups

By [email protected] (The Hacker News)

AI Summary

CVE-2026-93952 (CVSS 10.0) is a critical flaw in on-premises Arista VeloCloud Orchestrator actively exploited in the wild, enabling unauthenticated remote attackers to access privileged internal functions and affect the VCO host. Only orchestrators using certificate-based Edge authentication are vulnerable. SD-WAN operators running on-prem VCO deployments should treat this as a priority patch given active exploitation and maximum CVSS score.

Read full article → https://thehackernews.com/2026/09/new-cvss-100-vel…

Relevance score: 84.0/100

# More from September 23

  1. 1
    ShinyHunters claims FBI hack, data theft in PeopleSoft zero-day breach BleepingComputer
  2. 2
    EvilTokens PhaaS disrupted after compromising 12,000 Microsoft accounts BleepingComputer
  3. 3
    Check Point warns of Management Server zero-day exploited in attacks BleepingComputer
  4. 4
    WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers The Hacker News
  5. 5
    Zyxel and Veeam Flaws Under Active Exploitation With Command and SYSTEM Access The Hacker News
  6. 6
    New Linux Kernel Flaw Gives ARM64 KVM Guests Read-Write Access to Host Memory The Hacker News
  7. 8
    Google Fined €403 Million Over GDPR Violations Tied to Location Data The Hacker News
  8. 9
    Fake LastPass Installers Push Kernel-Level EDR Killer, ‘Rapuncel’ Stealer SecurityWeek
  9. 10
    Japan Dismantles First North Korean Laptop Farm as US and Allies Detail Wider Scheme SecurityWeek