9.1 CriticalCWE-89
CVE-2026-17191
VeloCloud Orchestrator Flow Metrics API SQL Injection
Arista NetworksVeloCloud Orchestrator On-Prem
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 26 Oct
0.3%probability of exploitation in the next 30 days
Higher than 28% of scored CVEs
SeverityCVSS
9.1Critical
Description NVD
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Coverage 1 article · 1 outlet
- Arista Warns of Actively Exploited VeloCloud Orchestrator BugSecurityOnline · first in our coverage · mentions it in passing