Arista patches exploited VeloCloud management flaw as more fixes remain pending

Image: Primary

Published Wednesday, September 23, 2026 · 10:53 AM EDT

Arista Networks has released patches for an actively exploited flaw affecting VeloCloud Orchestrator deployments that use certificate-based authentication with edge devices. The flaw, CVE-2026-93952, can let remote attackers reach privileged functions on the management host if they have access to the web interface and the public portion of an edge authentication certificate. Arista says it has patched hosted deployments on specified versions and plans fixes for older affected versions. The US Cybersecurity and Infrastructure Security Agency added the flaw to its known exploited vulnerabilities catalog and ordered federal civilian agencies to secure their networks by Friday, September 25.

Sources

BleepingComputer

Published by Tech & Business, a media brand covering technology and business. This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Security Infrastructure

Pwn.ai demonstrates Firecracker guest escape on a host running it as root

Pwn.ai says it escaped a Firecracker microVM and executed a chosen operation as root on the host while the virtual machine remained accessible over SSH.

Security Infrastructure

QNAP warns of suspected NAS compromises through Plex flaws

QNAP says it has received multiple reports of suspected compromises of customers' network storage devices through the Plex2Shell vulnerability chain. The company urges users to update Plex Media Server through its App Center to version 1.43.3.10861.

Security Infrastructure

Some WordPress sites remain exposed while installing security fix

Some WordPress sites remain vulnerable to server code execution while installing the fix for actively exploited CVE-2026-119977, researcher Umut Bayram warned.

Security

Chainalysis says breach exposed password hashes and live tokens for all users

Chainalysis said hackers obtained names, usernames, password hashes and live tokens for all its users following a breach of its network security.

Security

Gnosis Pay discloses customer data breach and adds payment checks

Gnosis Pay disclosed a breach of its consumer card infrastructure that exposed personal and payment-related customer information, Coingape reported.

Security

Veeam distributes fixes for critical Linux kernel vulnerability

Veeam said on Friday that some of its products are affected by CVE-2026-98432, a critical Linux kernel vulnerability, BleepingComputer reported. The flaw allows remote unauthenticated attackers to execute commands as root on servers running Multipath TCP listeners.