CVE-2026-17191: high-severity vulnerability in Arista Networks VeloCloud Orchestrator On-Prem
VeloCloud Orchestrator Flow Metrics API SQL Injection
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.4%
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/S:P
Affected products
Arista Networks · VeloCloud Orchestrator On-PremRelated CVEs — Arista Networks VeloCloud Orchestrator On-Prem
In the same product, most dangerous first.