CVE-2026-93952

Summary

The VeloCloud Orchestrator (VCO) on-premises version has a critical vulnerability that allows remote attackers to access privileged internal functionality, compromising the confidentiality, integrity, and availability of the orchestrator and its managed data.

Exploitability

Exploitation is relatively straightforward given the remote access vector and lack of user interaction required. The attacker needs network access to the VCO on-premises version.

Blast radius

If exploited, the impact is severe, as it can compromise the entire orchestrator and the data it manages, affecting multiple systems and services.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of VCO on-premises, specifically version 2.590 or later, as published by the vendor.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.