# CVE-2026-107243: Versa VOS Node.js web service session fixation via hardcoded secret

Source: https://junglewise.ai/threats/cve-2026-107243-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-107243 · Severity: high · CVSS 7.6 · Published 2026-11-10

Versa VOS is a network appliance platform used for Software-Defined WAN deployments. The appliance includes a Node.js web service used for initial setup and provisioning that persists on devices by default. An attacker can forge valid session cookies because the service uses an identical hardcoded secret across all devices, allowing unauthorized admin access to any unpatched appliance.

Technologies: [Versa-Networks VOS](https://junglewise.ai/threats/technologies/vos). Vendors: [Versa-Networks](https://junglewise.ai/threats/vendors/versa-networks).

## Quick answers

**Is CVE-2026-107243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-107243 being exploited in the wild.

**How severe is CVE-2026-107243?** High severity, with a CVSS score of 7.6, published 10 November 2026.

**Which products and versions are affected?** Versa Networks VOS.

**Is there a fix for CVE-2026-107243?** No fixed version is recorded yet. Disable the Node.js web service after initial provisioning is complete, per Versa's security hardening guide for Hubs, Branches, and Controllers. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-107243 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-107243?** Check whether you run Versa-Networks VOS. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the Node.js web service after initial provisioning is complete, per Versa's security hardening guide for Hubs, Branches, and Controllers.

## Technical details

The express-session middleware in the Node.js service uses a hardcoded, globally-shared secret to sign session cookies via HMAC-SHA256. An attacker who obtains any valid session ID can compute the correct signature and forge cookies accepted by any VOS appliance. The vulnerability requires network access to the Node.js web service port but no prior authentication; disabling the service post-provisioning eliminates the risk.

## Affected products

- Versa Networks VOS

## Timeline

- 2026-11-10: disclosed

## References

- [https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838](https://security-portal.versa-networks.com/emailbulletins/6af22ae2dd1c93ddc0a3e838)

## Related threats

- [Versa VOS hardcoded decryption key in Node.js web service](https://junglewise.ai/threats/cve-2026-107244-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used)
- [Versa VOS Node.js web service predictable session identifiers](https://junglewise.ai/threats/cve-2026-107242-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used)
- [Versa VOS Node.js web service authentication bypass with default credentials](https://junglewise.ai/threats/cve-2026-107241-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used)
- [Versa VOS command injection in Node.js ZTP service](https://junglewise.ai/threats/cve-2026-107240-the-node-js-web-service-on-vos-previously-versa-flexvnf-is-used)