# CVE-2026-17192: Arista VeloCloud Orchestrator SSRF due to missing input validation

Source: https://junglewise.ai/threats/cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-17192 · Severity: high · CVSS 8.5 · Published 2026-07-27

Arista VeloCloud Orchestrator, a platform used to manage SD-WAN networks, contains a vulnerability that allows authorized administrative users to bypass security boundaries. By exploiting this flaw, an attacker with existing 'Enterprise Standard Admin' credentials can force the system to make unauthorized requests to internal services that are normally protected. This could lead to the exposure of sensitive internal data or further access into the corporate network.

Technologies: [Arista Networks VeloCloud Orchestrator On-Prem](https://junglewise.ai/threats/technologies/velocloud-orchestrator-on-prem). Vendors: [Arista Networks](https://junglewise.ai/threats/vendors/arista-networks).

## Quick answers

**Is CVE-2026-17192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17192 being exploited in the wild.

**How severe is CVE-2026-17192?** High severity, with a CVSS score of 8.5, published 27 July 2026.

**Which products and versions are affected?** Arista Networks VeloCloud Orchestrator On-Prem 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4.

**Is there a fix for CVE-2026-17192?** A patch was published on 2026-07-27. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17192 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-17192?** Check whether you run Arista Networks VeloCloud Orchestrator On-Prem at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in Arista VeloCloud Orchestrator (VCO) On-Prem due to insufficient validation of caller-supplied input within a specific feature. An attacker with a valid session and a minimum role of 'Enterprise Standard Admin' can submit crafted requests that the orchestrator will execute on their behalf. This allows the attacker to reach internal services and network resources that are otherwise inaccessible from the external network. The vulnerability is tracked as BUG 1568526 and has been patched in versions 5.2.3.14, 6.1.3.4, and 6.4.2.4.

## Affected products

- Arista Networks VeloCloud Orchestrator On-Prem 5.2.x prior to 5.2.3.14, 6.1.x prior to 6.1.3.4, 6.4.x prior to 6.4.2.4

## Timeline

- 2026-07-27: disclosed: Discovered internally by Arista
- 2026-07-27: advisory
- 2026-07-27: patched

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145](https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145)

## Related threats

- [Arista VeloCloud Orchestrator SQL injection in flow metrics API](https://junglewise.ai/threats/cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api)
- [Arista VeloCloud Orchestrator OS command injection in on-prem host](https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem)