Skip to content

Product

Versa VOS vulnerabilities

6 published CVES affecting Versa VOS, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
1
High
5
Medium
0
Low
0
Unscored
0
CISA KEV
0

Latest Versa VOS CVEs

Newest publication first

  1. CVE-2026-107245 Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent....

    Published
    HighCVSS 7.5 EPSS 0.18%

    Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. Buffer Overflow Vulnerability Description When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An a...

  2. CVE-2026-107242 The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service gene...

    Published
    CriticalCVSS 9.1 EPSS 0.15%

    The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service generates session identifiers using UUID version 1 (UUIDv1), which is derived from t...

  3. CVE-2026-107240 The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate...

    Published
    HighCVSS 7.6 EPSS 0.32%

    The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to c...

  4. CVE-2026-107241 The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service auth...

    Published
    HighCVSS 7.6 EPSS 0.29%

    The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provision...

  5. CVE-2026-107243 The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-sessi...

    Published
    HighCVSS 7.6 EPSS 0.29%

    The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identic...

  6. CVE-2026-107244 The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest....

    Published
    HighCVSS 7.6 EPSS 0.30%

    The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentic...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.