Arista VeloCloud Orchestrator vulnerabilities

4 CVEs affecting Arista VeloCloud Orchestrator, 3 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-93952, published 2026-09-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-31431: Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability, published 2026-04-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-05-01. EPSS: 3.4% chance of exploitation in the next 30 days. In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the…
CVE-2026-93952: Arista VeloCloud Orchestrator Improper Input Validation Vulnerability, published 2026-09-22. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2026-09-22. EPSS: 1.1% chance of exploitation in the next 30 days. VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may…
CVE-2026-16812: Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability, published 2026-07-27. Critical severity, CVSS 10.0. Actively exploited: in CISA KEV since 2026-07-27. EPSS: 1% chance of exploitation in the next 30 days. VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may…
CVE-2020-3973, published 2020-07-08. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted…