New CVSS 100 VeloCloud Orchestrator Flaw Actively Exploited in CertificateBased Setups

Attackers are exploiting a new flaw in onpremises VeloCloud Orchestrator VCO the server that manages the Edge devices in a VeloCloud SDWAN Arista said on September 22 The flaw tracked as CVE202693952 may allow a remote attacker with no login access to privilege internal functions and affect the VCO host Only orchestrators set up to authenticate their Edges with certificates are