8.5 HighCWE-918
CVE-2026-17192
VeloCloud Orchestrator Missing Input Validation SSRF
Arista NetworksVeloCloud Orchestrator On-Prem
Status
- Not in CISA KEV
- Vendor fix available
Exploit probabilityEPSSchecked 25 Oct
0.3%probability of exploitation in the next 30 days
Higher than 21% of scored CVEs
SeverityCVSS
8.5High
Description NVD
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Coverage 1 article · 1 outlet
- Arista Warns of Actively Exploited VeloCloud Orchestrator BugSecurityOnline · first in our coverage · mentions it in passing