VulnerabilityAwaiting Analysis

CVE-2026-17192

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible.

MEDIUM 6.3EPSS 2.34%

Does this matter?

Lower severity and a low EPSS score (2.34%). Track it; it rarely justifies an emergency change on its own.

Description

A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standard Admin. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

CVSS 4.0: 6.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 2.34% probability · 83th percentile
CISA KEV: Not listed
Weakness: CWE-918
Source: psirt@arista.com

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.