CVE-2026-17192

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145

Configurations

No configuration.

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Una característica de VCO no valida suficientemente la entrada proporcionada por el llamador, lo que permite que se realicen solicitudes en nombre de cuentas de inquilino autenticadas a servicios internos que de otro modo no son accesibles. Esta vulnerabilidad requiere un rol mínimo de Administrador Estándar Empresarial. Este problema fue descubierto internamente por Arista y la empresa no tiene conocimiento de ningún uso malicioso de este problema en las redes de los clientes.

Information

Published : 2026-07-27 17:16

Updated : 2026-10-24 13:10

NVD link : CVE-2026-17192

Mitre link : CVE-2026-17192

CVE.ORG link : CVE-2026-17192

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-17192", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17192", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-27T17:28:28.227511Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@arista.com", "affectedData": [{"vendor": "Arista Networks", "product": "VeloCloud Orchestrator On-Prem", "versions": [{"status": "affected", "version": "5.2.0", "lessThan": "5.2.3.14", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThan": "6.1.3.4", "versionType": "custom"}, {"status": "affected", "version": "6.4.0", "lessThan": "6.4.2.4", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-27T17:16:35.573", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145", "source": "psirt@arista.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin.\n\n\n\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."}, {"lang": "es", "value": "Una caracter\u00edstica de VCO no valida suficientemente la entrada proporcionada por el llamador, lo que permite que se realicen solicitudes en nombre de cuentas de inquilino autenticadas a servicios internos que de otro modo no son accesibles. Esta vulnerabilidad requiere un rol m\u00ednimo de Administrador Est\u00e1ndar Empresarial.\n\nEste problema fue descubierto internamente por Arista y la empresa no tiene conocimiento de ning\u00fan uso malicioso de este problema en las redes de los clientes."}], "lastModified": "2026-10-24T13:10:00.147", "sourceIdentifier": "psirt@arista.com"}