Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-93952
By Roy Kalfon |
23 September 2026
CVE-2026-93952 – VeloCloud Orchestrator on-prem improper input validation enables unauthenticated access to privileged functionality
VeloCloud Orchestrator (VCO) On-Prem has CWE-20 improper input validation enabling remote, unauthenticated access to privileged internal functionality via the VCO web interface, impacting the VCO host. Exploited in the wild. Affected: 5.2.x=7.0.0.3. Restrict VCO UI to trusted admin networks.