CVE-2026-17191— VeloCloud Orchestrator Flow Metrics API SQL Injection
Quick assessment
Affected
Arista Networks VeloCloud Orchestrator On-Prem
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
协调器（orchestrator）的 API 组件中存在输入验证漏洞。经过身份验证的用户可利用此缺陷操纵后端查询，可能导致越权访问超出其预期权限的数据，并引发底层系统发起非预期的出站网络连接。 该问题由 Arista 内部发现，目前该公司未获悉在客户网络中存在针对此问题的恶意利用行为。
Possible ATT&CK Techniques 3 AI
T1059 · Command and Scripting Interpreter T1071 · Application Layer Protocol T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem | 5.2.0< 5.2.3.14 |
affected |
6.1.0< 6.1.3.4 |
affected | ||
6.4.0< 6.4.2.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-17191
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
VeloCloud Orchestrator Flow Metrics API SQL Injection
Source: CVE Program / CVE List V5
Vulnerability Description
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Arista Networks | VeloCloud Orchestrator On-Prem | 5.2.0 ~ 5.2.3.14 | - |
|
II. Public POCs for CVE-2026-17191
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-17191
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-17191 (1)
Same Patch Batch · Arista Networks · 2026-07-27 · 3 CVEs total
| CVE-2026-16812 | 10.0 CRITICAL | VeloCloud Orchestrator OS Command Injection |
| CVE-2026-17192 | 8.5 HIGH | VeloCloud Orchestrator Missing Input Validation SSRF |
IV. Related Vulnerabilities
Same vendor: Arista Networks
-
CVE-2026-93952
Security Advisory 0183 -
CVE-2026-73462
On affected platforms running Arista EOS with IGMP (Internet -
CVE-2026-73457
Under certain circumstances, the gNPSI client credentials mi -
CVE-2026-73456
Under certain circumstances, an unauthenticated gNPSI client -
CVE-2026-73442
On affected platforms running Arista EOS with VRRP enabled,
Same weakness: CWE-89
-
CVE-2026-18443
Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL In -
CVE-2026-96267
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthent -
CVE-2026-103913
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via -
CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injectio -
CVE-2026-95865
Beaver Builder Page Builder <= 2.11.0.5 - Authenticated (Con
V. Comments for CVE-2026-17191
No comments yet