{
  "intelligence": {
    "actors": [],
    "attack_details": {
      "coverage": "source-limited",
      "registry_sha256": "f22f36e35fac654ac463e15534dd9e1d1308f165d9b80d2b51b2a16b34915c11",
      "schema_version": 1,
      "source_paragraphs": 60,
      "sources": [
        {
          "document_sha256": "32fd195c5cd1ae65273da2434182f9260805572aa86eb8c1a021cb7928bca39f",
          "name": "www.arista.com",
          "retrieved_at": "2026-10-16T18:27:45.838314+00:00",
          "role": "primary",
          "source_id": "primary",
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
        },
        {
          "document_sha256": "4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
          "name": "nvd.nist.gov",
          "retrieved_at": "2026-10-16T18:27:45.838314+00:00",
          "role": "context",
          "source_id": "ref-01271320a5d0",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93952"
        }
      ],
      "steps": [
        {
          "date": "",
          "relation": "incident-step",
          "source_id": "primary",
          "text": "Les opérateurs doivent examiner les journaux d’accès Web VCO pour détecter toute activité inattendue."
        }
      ]
    },
    "counts": {
      "actors": 0,
      "associated_entity_contexts": 0,
      "deduplicated_iocs": 1,
      "direct_entities": 3,
      "direct_relationships": 1,
      "invalid_iocs": 0,
      "iocs": 1,
      "mentioned": 1,
      "mitre_associated": 0,
      "mitre_direct": 0,
      "targets": 0,
      "techniques": 0,
      "unsupported_indicators": 0,
      "vulnerabilities": 1
    },
    "coverage": {
      "associated_repertoire_is_incident_evidence": false,
      "attribution_policy": "explicit-public-relationships-only",
      "descriptions_publicly_exported": false,
      "excluded_context_objects": 0,
      "excluded_graph_objects": 51,
      "graph_complete": true,
      "graph_objects": 3,
      "graph_relationships": 1,
      "mitre_context_complete": true,
      "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
      "status_as_of": "2026-10-16T18:27:11+00:00",
      "table_preview_limit": 20
    },
    "direct_entities": [
      {
        "__typename": "Indicator",
        "aliases": [],
        "attributes": {
          "pattern_type": "stix",
          "pattern_version": "2.1",
          "x_opencti_detection": false,
          "x_opencti_main_observable_type": "StixFile",
          "x_opencti_score": 50
        },
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:59:11.172Z",
          "created_at": "2026-09-26T19:42:48.726Z",
          "modified": "2026-09-26T19:42:52.119Z",
          "updated_at": "2026-09-26T19:42:52.119Z"
        },
        "description_available": false,
        "entity_type": "Indicator",
        "id": "3721f421-0318-47ec-a56f-62081a2d3a75",
        "is_inferred": false,
        "labels": [
          "active exploitation",
          "certificate authentication bypass",
          "cve-2026-93952",
          "privileged access",
          "remote exploitation",
          "velocloud orchestrator"
        ],
        "lang": "en",
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
        "standard_id": "indicator--c7c34874-8756-5ca6-ba3b-78ab80ebfff0",
        "type": "Indicator"
      },
      {
        "__typename": "Vulnerability",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": 80,
        "created_by": null,
        "dates": {
          "created": "2026-09-22T00:00:00.000Z",
          "created_at": "2026-09-22T08:34:28.642Z",
          "modified": "2026-09-26T19:42:45.842Z",
          "updated_at": "2026-09-26T19:42:45.842Z"
        },
        "description_available": true,
        "entity_type": "Vulnerability",
        "id": "3e439056-dcd3-4a57-bad0-2b6f819b388d",
        "is_inferred": false,
        "labels": [],
        "lang": "en",
        "name": "CVE-2026-93952",
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [
          {
            "external_id": "CVE-2026-93952",
            "id": "fddf2b9e-26ad-4a57-931d-cad4daa159a8",
            "source_name": "NIST NVD",
            "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93952"
          },
          {
            "external_id": null,
            "id": "f2efaf31-6ef8-42b1-97c5-2a4943e6207b",
            "source_name": "psirt@arista.com",
            "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
          }
        ],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
        "standard_id": "vulnerability--54f46dca-4e6a-5257-8156-776d421d4dc9",
        "type": "Vulnerability"
      },
      {
        "__typename": "StixFile",
        "aliases": [],
        "attributes": {},
        "authorized_members": [],
        "confidence": null,
        "created_by": null,
        "dates": {
          "created_at": "2026-09-26T19:42:48.341Z",
          "updated_at": "2026-09-26T19:42:49.218Z"
        },
        "description_available": false,
        "entity_type": "StixFile",
        "id": "517d7162-ba94-47f5-b6b7-1c68b7ecc176",
        "is_inferred": false,
        "labels": [
          "active exploitation",
          "certificate authentication bypass",
          "cve-2026-93952",
          "privileged access",
          "remote exploitation",
          "velocloud orchestrator"
        ],
        "lang": null,
        "name": null,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
        "standard_id": "file--9d33505e-7163-58f3-bdf4-936a7234704a",
        "type": "StixFile"
      }
    ],
    "direct_relationships": [
      {
        "__typename": "StixCoreRelationship",
        "authorized_members": [],
        "confidence": 50,
        "created_by": null,
        "dates": {
          "created": "2026-09-24T16:59:11.173Z",
          "created_at": "2026-09-26T19:43:10.724Z",
          "modified": "2026-09-26T19:43:13.139Z",
          "start_time": "1970-01-01T00:00:00.000Z",
          "stop_time": "5138-11-16T09:46:40.000Z",
          "updated_at": "2026-09-26T19:43:13.139Z"
        },
        "description_available": false,
        "entity_type": "based-on",
        "fromId": "3721f421-0318-47ec-a56f-62081a2d3a75",
        "from_id": "3721f421-0318-47ec-a56f-62081a2d3a75",
        "from_name": null,
        "from_type": "Indicator",
        "id": "dafd7260-7153-47e7-ae1c-5221284e1345",
        "is_inferred": false,
        "objectMarking": [
          {
            "definition": "TLP:CLEAR",
            "definition_type": "TLP"
          }
        ],
        "objectOrganization": [],
        "references": [],
        "relationship_type": "based-on",
        "restrict_access": false,
        "revoked": false,
        "scope": "report",
        "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
        "standard_id": "relationship--cf22955d-fdc3-5000-ae56-5e0c5a4cb824",
        "toId": "517d7162-ba94-47f5-b6b7-1c68b7ecc176",
        "to_id": "517d7162-ba94-47f5-b6b7-1c68b7ecc176",
        "to_name": null,
        "to_type": "StixFile"
      }
    ],
    "iocs": [
      {
        "classification": "indicator",
        "confidence": 50,
        "context": "Objet Indicator explicitement associé au rapport source.",
        "defanged": "dc78e206eaeadec59fc5801fe4556bd0",
        "description_available": false,
        "object_id": "3721f421-0318-47ec-a56f-62081a2d3a75",
        "object_ids": [
          "3721f421-0318-47ec-a56f-62081a2d3a75",
          "517d7162-ba94-47f5-b6b7-1c68b7ecc176"
        ],
        "source_objects": [
          {
            "classification": "indicator",
            "confidence": 50,
            "context": "Objet Indicator explicitement associé au rapport source.",
            "object_id": "3721f421-0318-47ec-a56f-62081a2d3a75",
            "valid_from": "2026-09-23T16:45:44.000Z",
            "valid_until": "2027-07-11T03:55:28.557Z",
            "validity_status": "active",
            "value": "dc78e206eaeadec59fc5801fe4556bd0"
          },
          {
            "classification": "observable",
            "confidence": null,
            "context": "Objet StixFile explicitement associé au rapport source.",
            "object_id": "517d7162-ba94-47f5-b6b7-1c68b7ecc176",
            "valid_from": null,
            "valid_until": null,
            "validity_status": "undated",
            "value": "dc78e206eaeadec59fc5801fe4556bd0"
          }
        ],
        "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183",
        "type": "md5",
        "valid_from": "2026-09-23T16:45:44.000Z",
        "valid_until": "2027-07-11T03:55:28.557Z",
        "validity_status": "active",
        "value": "dc78e206eaeadec59fc5801fe4556bd0"
      }
    ],
    "mentioned": [
      {
        "confidence": 80,
        "evidence_id": "3e439056-dcd3-4a57-bad0-2b6f819b388d",
        "name": "CVE-2026-93952",
        "role": "mentionné",
        "type": "Vulnerability"
      }
    ],
    "mitre": {
      "associated_repertoire": [],
      "direct_techniques": []
    },
    "report_metadata": {
      "authorized_members": [],
      "confidence": 50,
      "created_by": null,
      "dates": {
        "created": "2026-09-23T16:45:43.415Z",
        "created_at": "2026-09-26T19:43:33.878Z",
        "modified": "2026-09-26T19:43:34.505Z",
        "published": "2026-09-23T16:45:43.415Z",
        "updated_at": "2026-09-26T19:43:34.505Z"
      },
      "description_available": true,
      "id": "8978e9aa-0dce-4dbf-8777-ea96ce55f0fa",
      "is_inferred": false,
      "labels": [
        "active exploitation",
        "certificate authentication bypass",
        "cve-2026-93952",
        "privileged access",
        "remote exploitation",
        "velocloud orchestrator"
      ],
      "lang": "en",
      "name": "VeloCloud Orchestrator Remote Access Vulnerability",
      "objectMarking": [
        {
          "definition": "TLP:CLEAR",
          "definition_type": "TLP"
        }
      ],
      "objectOrganization": [],
      "published": "2026-09-23T16:45:43.415Z",
      "references": [
        {
          "external_id": "6ab4023773b652cd342e0854",
          "id": "61d22c54-ac4a-4ef6-8fc5-6668f8d2ce13",
          "source_name": "alien-vault",
          "url": "https://otx.alienvault.com/pulse/6ab4023773b652cd342e0854"
        },
        {
          "external_id": null,
          "id": "f2efaf31-6ef8-42b1-97c5-2a4943e6207b",
          "source_name": "psirt@arista.com",
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
        }
      ],
      "report_types": [
        "threat-report"
      ],
      "restrict_access": false,
      "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
    },
    "targets": [],
    "techniques": [],
    "vulnerabilities": [
      "CVE-2026-93952"
    ]
  },
  "report_id": "8978e9aa-0dce-4dbf-8777-ea96ce55f0fa",
  "schema_version": 1,
  "selected_date": "2026-09-23",
  "source_url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183"
}