VOS: Weak Authentication
CVE-2026-107244 is a high-severity weak authentication vulnerability in VOS from Versa, with a CVSS 3.0 base score of 7.6 out of 10. It can be exploited remotely over the network by an attacker with administrator privileges, but only if a user takes part, for example by opening a link or file. The record lists version July 2, 2026 as the first without the flaw, so updating VOS to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.3% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update VOS to July 2, 2026 or a later version.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Versa | VOS | 21.1.1 through 21.2.3; 22.1.2 up to, but not including, July 2, 2026; 22.1.3 up to, but not including, July 2, 2026; 22.1.4 up to, but not including, July 2, 2026; 23.1.2 up to, but not including, July 2, 2026 | July 2, 2026 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- HighAdministrator-level access is required first.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- ChangedThe attack can reach beyond the vulnerable component into other systems.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H. Scored by CNA (hackerone.com).
Official description
The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Weak Authentication
The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other vulnerabilities in VOS
- 7.5 High severity
- 7.6 High severity
- 9.1 Critical severity
- 7.6 High severity
- 7.6 High severity
Recent Weak Authentication vulnerabilities
- 7.0 High severity
- 7.5 High severity
- 8.1 High severity
- 8.8 High severity
- 7.1 High severity
- 9.3 Critical severity
Spotted an error? Tell us.