CVE WatchCVE-2026-93952

CVE-2026-93952CVSS 10 · CRITICAL⚡ CISA KEV — Actively ExploitedPublished September 22, 2026

VeloCloud Orchestrator Input Validation Bypass Enables Privileged Access

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

VeloCloud Orchestrator (VCO) on-premises deployments contain a critical input validation flaw (CWE-20) that allows unauthenticated remote attackers to bypass security controls and gain access to privileged internal functionality. This vulnerability is actively exploited in the wild according to CISA, making it an immediate threat to organizations relying on VCO for SD-WAN infrastructure management. The impact is severe: successful exploitation compromises confidentiality, integrity, and availability across the orchestrator and all managed data. While hosted and dedicated VCO versions have been patched, on-premises customers remain vulnerable if they haven't applied fixes, making this a critical prioritization for network infrastructure teams.

Casky's 323 matched security skills detect the attack patterns associated with this vulnerability by analyzing techniques across Initial Access (TA0001) and Persistence (TA0043). Practitioners using Casky would identify reconnaissance activity probing for VCO instances, followed by exploitation attempts sending malformed input to bypass validation checks. The platform's Claude AI reasoning capability correlates indicators such as: unusual API requests with crafted payloads targeting input processing endpoints, successful authentication without proper credentials, and subsequent privilege escalation activities accessing internal management functions. Security teams would see findings highlighting suspicious request patterns, anomalous authentication chains, and post-exploitation lateral movement attempts—enabling detection of both active attacks and compromise indicators in VCO environments.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-93952.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-93952

Casky has 323 skills that investigate the attack patterns behind CVE-2026-93952. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn