CVE-2026-93952

CriticalCVSS 10.0/10Known exploited (CISA KEV)Last modified Sep 23, 2026

Description

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Sep 22, 2026
Last modified
Sep 23, 2026
Added to CISA KEV
Sep 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-939538.0The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (seconCVE-2026-939544.3A security vulnerability has been detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected is the function AppSettingController.getApCVE-2026-939554.3A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponCVE-2026-939563.5A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file srCVE-2026-939574.3A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file srCVE-2026-939589.1A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the componentCVE-2026-939597.3A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the fiCVE-2026-93963.7A security flaw has been discovered in Besen BS20 EV Charging Station up to 20260426. Affected by this vulnerability is an unknown functionaCVE-2026-939604.3A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1CCVE-2026-939615.3A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/CVE-2026-939628.3A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file sCVE-2026-939636.3A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module