Is there a patch available for CVE-2026-17191?

Yes, a patch is available for CVE-2026-17191. Update the affected software to the latest version immediately.

Velocloud Orchestrator On Prem CVE-2026-17191

Q: What is the CVSS score of CVE-2026-17191?

CVE-2026-17191 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 2.8%.

EUVD-2026-49371 HIGH

SQL Injection (CWE-89)

2026-07-27 Arista

GHSA-h4j3-v76m-hmm4

Authentication Bypass SQLi Velocloud Orchestrator On Prem Arista Networks

8.5

CVSS 4.0 · Vendor: Arista

Severity by source

Vendor (Arista) PRIMARY

8.5 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (Arista) · only source for this CVE.

CVSS VectorVendor: Arista

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 27, 2026 - 18:02 EUVD

Analysis Generated

Jul 27, 2026 - 17:32 vuln.today

Severity Changed

Jul 27, 2026 - 17:22 NVD

CRITICAL HIGH

CVSS changed

Jul 27, 2026 - 17:22 NVD

9.1 (CRITICAL) 8.5 (HIGH)

CVE Published

Jul 27, 2026 - 16:41 cve.org

HIGH 8.5

DescriptionCVE.org

An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

AnalysisAI

We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields.

CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.

CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:* Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov.

Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)