CSAIS
IDEN
HighEarly warningMalwareUnited states · Spanish

Arista VeloCloud Zero-Day CVE-2026-93952: CVSS 10.0

First seen 22 Sept, 14:00 WIBLatest 23 Sept5 articles · 4 publishers · 1 syndicated
actor: remoteVerify evidence
79
Confidence index · preliminarycomputed by the pipeline (V0.7)high
Corroborated by distinct domains
Independent sources
Victim identified
Full text available
Clustering consistency
Status and preventive steps
Early warningMachine output from news coverage; not verified by the public or institutions
Preventive steps
  • Turn on two-step verification for email, banking, and social media.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Literacy audienceSocial media and messaging usersHomemakersIT staff and system administrators
Literacy topics
  1. The danger of APK files and unofficial apps
  2. System updates and security patches
  3. How to report and keep evidence

Report toPatroli Siber Polri

Extracted claims

Victimconfidence 0.60
VCO
Actorconfidence 0.60
Remote
Attack typeconfidence 0.90
Malware3 differing values across articles; review needed.
Event datenot found
not identified
LocationUnited states
Target groupIndividuals
Status
  • D1 Machinehigh trust
Conclusion
  • D1 MachineHappened

Source chronology

5 articles, by publication time

22 September 20262 articles

  1. 14:00 WIBFirst reportfull text hashed
    Arista VeloCloud Zero-Day CVE-2026-93952: CVSS 10.0shattered.io
  2. 19:29 WIB+5 hfull text hashed
    New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setupsthehackernews.comVCO

23 September 20263 articles

  1. 15:33 WIB+26 hfull text hashed
    Arista Urges Immediate Patching of Exploited VCO Zero-Daysecurityweek.com
  2. 15:49 WIB+26 hSyndicatedfull text hashed
    Arista Urges Immediate Patching of Exploited VCO Zero-Daysecurityweek.com
Show all 5 articlesCollapse

23 September 2026 · continued3 articles

  1. 19:29 WIB+29 hfull text hashed
    Arista patches actively exploited VeloCloud Orchestrator zero-daybleepingcomputer.comRemote
Relations between articles
9 pairs likely independent1 pairs likely duplicate

Evidence

Hashes prepared5full text hashed 5
first evidence_uid2f136e99df0b849cbfd30f8c
5 of 5 evidence records are in Merkle batches

Flow comparison D1–D4

each flow's preventive output; this is where they differ · D1 changed 5 times · since 29 Sept
D1Machine12 OctD2Public surveynone yetHelp reviewD3Institutionnone yetD4Official recordnone yet
Literacy audienceSocial media and messaging usersHomemakersIT staff and system administrators–––
Literacy topics
  1. 1.The danger of APK files and unofficial apps
  2. 2.System updates and security patches
  3. 3.How to report and keep evidence
–––
Preventive steps
  • Turn on two-step verification for email, banking, and social media.
  • Install apps only from official stores and never open APK files sent over chat.
  • Keep the operating system and apps updated and leave built-in protection on.
Report to Patroli Siber Polri
–––
Institution's reason––––

Columns D2 to D4 fill in once the public survey and institution statements are running.Summary across incidents

Related incidents

semantic similarity of the coverage, across languages
English coveragesimilarity 89%Arista patches critical command injection flaw in VeloCloud Orchestrator exploited in attacks+2Vulnerability exploitation6 articles · 6 domains72