CVE-2026-17192 — VeloCloud Orchestrator Missing Input Validation SSRF
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not oth…
Published: 2026-07-27 · CVSS: 6.3 · CVSS 4.0
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7