VeloCloud Orchestrator unauth RCE, exploited (CVE-2026-93952)

Actively exploited in the wild - CVE-2026-93952 is a critical unauthenticated access flaw in on-prem VeloCloud Orchestrator (VCO) that lets a remote attacker reach privileged internal functionality and compromise the orchestrator host. Cisco has patched hosted and Dedicated VCO instances, but on-prem deployments must be updated by the operator.

Overview

VeloCloud Orchestrator is the management plane for VMware VeloCloud SD-WAN. It configures edges, pushes policy, and holds operational data for the whole fabric. CVE-2026-93952 exposes internal functionality that should never be reachable without authentication. A remote attacker with network access to the VCO management interface can send crafted requests and invoke privileged operations directly.

The CVSS score is 10.0. That is the maximum. The attack vector is network, complexity is low, and no privileges or user interaction are required. An attacker who can reach the orchestrator does not need credentials, a victim to click anything, or a race condition to win.

Impact

Successful exploitation compromises the confidentiality, integrity, and availability of the orchestrator and the data it manages. In practice this means:

• Configuration and policy data for the SD-WAN fabric can be read or altered.
• The VCO host itself can be affected, which puts the management plane at risk.
• An attacker who controls the orchestrator may be able to push changes to managed edges, extending the blast radius from one server to the entire network.

Because the orchestrator is the trust anchor for the SD-WAN deployment, compromise at this layer is unusually severe. Edge devices treat VCO instructions as authoritative.

Remediation

On-prem operators should treat this as an emergency change.

1. Upgrade VCO to the current release. Hosted and Dedicated versions were patched already; the on-prem build is the one you own.
2. If you cannot upgrade immediately, restrict network reachability to the VCO management interface. Place it behind a management VPN, allowlist only known administrator addresses, and remove any internet-facing exposure.
3. Rotate credentials and API tokens used by the orchestrator, and review audit logs for unexpected privileged calls.
4. Check edge configuration for unauthorized policy changes, since an attacker with orchestrator control could have modified the fabric.

If you observe signs of compromise, follow your incident response process and review breach reports for related activity in the wider ecosystem.

Security Insight

CVE-2026-93952 fits a pattern that has defined 2025 and 2026: management planes are the new perimeter. Attackers have learned that the orchestrator, the controller, and the hypervisor are worth more than any single endpoint, because compromising them yields control of everything downstream. A CVSS 10.0 with no privileges required and confirmed exploitation in the wild is about as bad as a vulnerability gets, and the fact that the fix shipped to hosted customers first is a reminder that on-prem operators carry the patching burden themselves. If your SD-WAN management interface is reachable from anywhere other than a locked-down admin network, that exposure should be closed before anything else on your list.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs