Arista Networks
Monthly
We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields. CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:* Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov. Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)
Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet destined for a configured decapsulation IP to be silently unwrapped and forwarded into the network. Unauthenticated remote attackers (PR:N, AV:N per CVSS 4.0) can inject traffic into network segments by exploiting this check bypass on switches with VXLAN, decap-groups, or GRE configurations. The CVE description explicitly states this issue has been reported as exploited in the wild; however, a CISA KEV entry was not confirmed in the provided data. The integrity impact is assessed as low on both the vulnerable and subsequent systems per CVSS 4.0 (VI:L/SI:L), but the network trust boundary violation in a core switching context warrants elevated operational priority.
We need to produce a JSON object with all the specified fields. The input provides CVE-2026-17192, description, CVSS 4.0 vector, CWE, tags, references, CPE, and note about internal discovery. No EPSS, no KEV, no POC mentioned. So exploitation status: no public exploit identified. Patch status: need to check references. The advisory URL is provided. We need to extract patch version info. Since it's a security advisory from Arista, likely they have a fixed version. But the input does not explicitly state the fix version. We should check the advisory URL content? But we only have the URL, not the content. However, the instruction says "Use ALL the data provided". The references contain advisory URL. We can assume that patch is available per vendor advisory, but we don't have an exact version. The CPE indicates the product is "arista_networks:velocloud_orchestrator_on-prem". So product name: "Velocloud Orchestrator On-Prem". But careful: The description says "A VCO feature" - VCO likely stands for Velocloud Orchestrator. So product_name: "Velocloud Orchestrator". The CPE says "velocloud_orchestrator_on-prem". So we'll use "Velocloud Orchestrator". Summary: Need original synthesis, not copying description. The vulnerability is an SSRF via VCO feature that doesn't validate input, allowing authenticated tenant admins to make requests to internal services. Minimum role Enterprise Standard Admin. No known exploitation. Technical context: CWE-918 is Server-Side Request Forgery. Explain SSRF, how the VCO feature works, using CPE to identify affected product. Risk assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N. So low impact on vulnerable system (no CIA), but high impact on subsequent system (confidentiality high, integrity low). That means the SSRF allows accessing internal services (subsequent system) and potentially reading sensitive data. But note that exploit requires authenticated user with Enterprise Standard Admin role. So PR:L is
Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Arista CloudVision Exchange (CVX) allows an attacker with high-privilege access to a connected switch to crash CVX agents by sending malformed TCP packets, causing instability across the CVX cluster. The flaw stems from improper input validation (CWE-20) of messages received from connected switches, and no public exploit has been identified at time of analysis.
Denial of service in Arista EOS switches and CloudVision Exchange (CVX) servers arises from improper input validation in the TCP messaging protocol that governs EOS-CVX cluster communication. Sending malformed messages in either direction - from a CVX server to an EOS switch, or vice versa - triggers a Sysdb agent crash on the EOS device (causing a soft reset) or agent crashes on the CVX server (causing cluster-wide instability). Exploitation requires the attacker to already hold high-privilege access on a device within the cluster, and no public exploit code or CISA KEV listing exists at time of analysis, making this a targeted insider or post-compromise threat rather than an opportunistic one.
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields. CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:* Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov. Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)
Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet destined for a configured decapsulation IP to be silently unwrapped and forwarded into the network. Unauthenticated remote attackers (PR:N, AV:N per CVSS 4.0) can inject traffic into network segments by exploiting this check bypass on switches with VXLAN, decap-groups, or GRE configurations. The CVE description explicitly states this issue has been reported as exploited in the wild; however, a CISA KEV entry was not confirmed in the provided data. The integrity impact is assessed as low on both the vulnerable and subsequent systems per CVSS 4.0 (VI:L/SI:L), but the network trust boundary violation in a core switching context warrants elevated operational priority.
We need to produce a JSON object with all the specified fields. The input provides CVE-2026-17192, description, CVSS 4.0 vector, CWE, tags, references, CPE, and note about internal discovery. No EPSS, no KEV, no POC mentioned. So exploitation status: no public exploit identified. Patch status: need to check references. The advisory URL is provided. We need to extract patch version info. Since it's a security advisory from Arista, likely they have a fixed version. But the input does not explicitly state the fix version. We should check the advisory URL content? But we only have the URL, not the content. However, the instruction says "Use ALL the data provided". The references contain advisory URL. We can assume that patch is available per vendor advisory, but we don't have an exact version. The CPE indicates the product is "arista_networks:velocloud_orchestrator_on-prem". So product name: "Velocloud Orchestrator On-Prem". But careful: The description says "A VCO feature" - VCO likely stands for Velocloud Orchestrator. So product_name: "Velocloud Orchestrator". The CPE says "velocloud_orchestrator_on-prem". So we'll use "Velocloud Orchestrator". Summary: Need original synthesis, not copying description. The vulnerability is an SSRF via VCO feature that doesn't validate input, allowing authenticated tenant admins to make requests to internal services. Minimum role Enterprise Standard Admin. No known exploitation. Technical context: CWE-918 is Server-Side Request Forgery. Explain SSRF, how the VCO feature works, using CPE to identify affected product. Risk assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N. So low impact on vulnerable system (no CIA), but high impact on subsequent system (confidentiality high, integrity low). That means the SSRF allows accessing internal services (subsequent system) and potentially reading sensitive data. But note that exploit requires authenticated user with Enterprise Standard Admin role. So PR:L is
Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service in Arista CloudVision Exchange (CVX) allows an attacker with high-privilege access to a connected switch to crash CVX agents by sending malformed TCP packets, causing instability across the CVX cluster. The flaw stems from improper input validation (CWE-20) of messages received from connected switches, and no public exploit has been identified at time of analysis.
Denial of service in Arista EOS switches and CloudVision Exchange (CVX) servers arises from improper input validation in the TCP messaging protocol that governs EOS-CVX cluster communication. Sending malformed messages in either direction - from a CVX server to an EOS switch, or vice versa - triggers a Sysdb agent crash on the EOS device (causing a soft reset) or agent crashes on the CVX server (causing cluster-wide instability). Exploitation requires the attacker to already hold high-privilege access on a device within the cluster, and no public exploit code or CISA KEV listing exists at time of analysis, making this a targeted insider or post-compromise threat rather than an opportunistic one.
On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.