Get real-time updates on Telegram
CVE-2026-17191: VeloCloud Orchestrator On-Prem 5.2.0 to before 5.2.3.14, 6.1.0 to before 6.1.3.4, 6.4.0 to before 6.4.2.4
CVE-2026-17191. CVSS 3.1 base score 9.1 (CRITICAL, Vendor/CNA). EPSS 0.0035 (percentile 0.27438), scored 22-Oct-2026.
Affected technology
VeloCloud Orchestrator On-Prem · 5.2.0 to before 5.2.3.14, 6.1.0 to before 6.1.3.4, 6.4.0 to before 6.4.2.4
Arista Networks
Component: Not specified by the source
Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality impact as high; integrity and availability impact as low.
- CWE
- CWE-89
- CCR priority
- 36.5 /100 (P4)
- CVSS 3.1
- 9.1 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L · Vendor/CNA
- EPSS
- 0.0035 · percentile 0.27508 · 2026-10-24
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-17191.html