CVE-2026-107240

Published 10 November 2026 · tracked since 10 November 2026

Description

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec()

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-119303 MEDIUM 5.3
• CVE-2026-119035 MEDIUM 6.4
• CVE-2026-119034 MEDIUM 5.3
• CVE-2026-119032 MEDIUM 5.3
• CVE-2026-118439 MEDIUM 4.1
• CVE-2026-118420 MEDIUM 6.8
• CVE-2026-118418 MEDIUM 5.3
• CVE-2026-118041 HIGH 8.8
• CVE-2026-117523 MEDIUM 4.3
• CVE-2026-117522 MEDIUM 6.8

→ Open the live CVE board · all tools