Arista Velocloud Orchestrator vulnerabilities

CVE-2026-93952 Critical · 10.0 KEV High · 58 CWE-20 Sep 22, 2026

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVE-2026-16812 Critical · 10.0 KEV High · 57 CWE-78 Jul 27, 2026

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

CVE-2026-31431 High · 7.8 KEV Urgent · 72 Public exploit CWE-669 Apr 22, 2026

Linux Kernel Incorrect Resource Transfer Between Spheres Vulnerability

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.