CVE-2026-17191

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17191", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-07-24T19:03:13.728Z", "datePublished": "2026-07-27T16:41:17.436Z", "dateUpdated": "2026-07-27T17:29:45.538Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-07-27T16:41:17.436Z"}, "title": "VeloCloud Orchestrator Flow Metrics API SQL Injection", "datePublic": "2026-07-27T16:37:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66: SQL Injection"}]}], "affected": [{"vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.3.14", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.3.4", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThan": "6.4.2.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.</p>\n<p>This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.</p>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145", "name": "Security Advisory 0145", "tags": ["vendor-advisory"]}], "configurations": [{"lang": "en", "value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only, the lowest built-in tenant role. No non-default configuration is required.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is <strong>Enterprise Read Only</strong>, the lowest built-in tenant role. No non-default configuration is required.</p>"}]}], "workarounds": [{"lang": "en", "value": "Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:</p>\n<ul>\n<li>Restrict access to the VCO web interface to trusted administrative networks.</li>\n<li>Monitor the VCO for accesses from known malicious source IPs.</li>\n<li>Monitor for unexpected outbound network activity from the VCO host.</li>\n<li>Review recent administrator activity for unexpected changes.</li>\n</ul>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\n\n\n\nThese vulnerabilities have been fixed in the following releases:\n\n\n\n * VCO 5.2.3.14 and later in the 5.2 train\n\n * VCO 6.1.3.4 and later in the 6.1 train\n\n * VCO 6.4.2.4 and later in the 6.4 train", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.</p>\n<p>These vulnerabilities have been fixed in the following releases:</p>\n<ul>\n<li>VCO <strong>5.2.3.14</strong> and later in the 5.2 train</li>\n<li>VCO <strong>6.1.3.4</strong> and later in the 6.1 train</li>\n<li>VCO <strong>6.4.2.4</strong> and later in the 6.4 train</li>\n</ul>"}]}], "source": {"defect": ["BUG 1568507"], "advisory": "145", "discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}, "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "LOW", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subAvailabilityImpact": "LOW", "exploitMaturity": "NOT_DEFINED", "Safety": "PRESENT", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-27T17:29:37.640962Z", "id": "CVE-2026-17191", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T17:29:45.538Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-17191", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:29:37.640962Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-27T17:29:42.423Z"}}], "cna": {"title": "VeloCloud Orchestrator Flow Metrics API SQL Injection", "source": {"defect": ["BUG 1568507"], "advisory": "145", "discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66: SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.3.14", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.3.4", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThan": "6.4.2.4", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.\n\n\n\n\nThese vulnerabilities have been fixed in the following releases:\n\n\n\n * VCO 5.2.3.14 and later in the 5.2 train\n\n * VCO 6.1.3.4 and later in the 6.1 train\n\n * VCO 6.4.2.4 and later in the 6.4 train", "supportingMedia": [{"type": "text/html", "value": "<p>The recommended resolution is to upgrade to a fixed VCO release at your earliest convenience.</p>\n<p>These vulnerabilities have been fixed in the following releases:</p>\n<ul>\n<li>VCO <strong>5.2.3.14</strong> and later in the 5.2 train</li>\n<li>VCO <strong>6.1.3.4</strong> and later in the 6.1 train</li>\n<li>VCO <strong>6.4.2.4</strong> and later in the 6.4 train</li>\n</ul>", "base64": false}]}], "datePublic": "2026-07-27T16:37:00.000Z", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145", "name": "Security Advisory 0145", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:\n\n\n\n * Restrict access to the VCO web interface to trusted administrative networks.\n\n * Monitor the VCO for accesses from known malicious source IPs.\n\n * Monitor for unexpected outbound network activity from the VCO host.\n\n * Review recent administrator activity for unexpected changes.", "supportingMedia": [{"type": "text/html", "value": "<p>Until the fixed software is deployed, operators should apply defense-in-depth controls appropriate for their environment:</p>\n<ul>\n<li>Restrict access to the VCO web interface to trusted administrative networks.</li>\n<li>Monitor the VCO for accesses from known malicious source IPs.</li>\n<li>Monitor for unexpected outbound network activity from the VCO host.</li>\n<li>Review recent administrator activity for unexpected changes.</li>\n</ul>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.", "supportingMedia": [{"type": "text/html", "value": "<p>An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.</p>\n<p>This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "configurations": [{"lang": "en", "value": "A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is Enterprise Read Only, the lowest built-in tenant role. No non-default configuration is required.", "supportingMedia": [{"type": "text/html", "value": "<p>A successful attack requires a valid authenticated session on the VCO portal. The minimum user role required is <strong>Enterprise Read Only</strong>, the lowest built-in tenant role. No non-default configuration is required.</p>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-07-27T16:41:17.436Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17191", "state": "PUBLISHED", "dateUpdated": "2026-07-27T17:29:45.538Z", "dateReserved": "2026-07-24T19:03:13.728Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-07-27T16:41:17.436Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VeloCloud Orchestrator On-Prem", "vendor": "Arista Networks", "versions": [{"lessThan": "5.2.3.14", "status": "affected", "version": "5.2.0", "versionType": "custom"}, {"lessThan": "6.1.3.4", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThan": "6.4.2.4", "status": "affected", "version": "6.4.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."}, {"lang": "es", "value": "Una vulnerabilidad de validaci\u00f3n de entrada existe en un componente de la API del orquestador. Un usuario autenticado puede explotar esta falla para manipular consultas de backend, lo que puede resultar en acceso no autorizado a datos m\u00e1s all\u00e1 de sus privilegios previstos y causar que el sistema subyacente inicie conexiones de red salientes no intencionadas.\n\nEste problema fue descubierto internamente por Arista y la empresa no tiene conocimiento de ning\u00fan uso malicioso de este problema en redes de clientes."}], "id": "CVE-2026-17191", "lastModified": "2026-10-24T13:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.3, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "PRESENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17191", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-27T17:29:37.640962Z", "version": "2.0.3"}}]}, "published": "2026-07-27T17:16:35.407", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2.0,5.2.3.14)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0,6.1.3.4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.4.0,6.4.2.4)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "VeloCloud Orchestrator On-Prem", "source": "cna", "vendor": "Arista Networks"}, "product": "velocloud_orchestrator_on-prem", "vendor": "arista_networks"}], "created": "2026-07-27T20:36:33.729393+00:00", "updated": "2026-09-24T18:30:15.362565+00:00", "vendors": ["arista_networks", "arista_networks$PRODUCT$velocloud_orchestrator_on-prem"]}