CVE-2026-107243

Published 10 November 2026 · tracked since 10 November 2026

Description

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS ap

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-124604 MEDIUM 6.2
• CVE-2026-124603 MEDIUM 6.2
• CVE-2026-124602 MEDIUM 6.2
• CVE-2026-124601 MEDIUM 6.2
• CVE-2026-124599 MEDIUM 6.2
• CVE-2026-124598 HIGH 7.5
• CVE-2026-109810 MEDIUM 6.1
• CVE-2026-109799 HIGH 7.5
• CVE-2026-109797 HIGH 7.1
• CVE-2026-107244 HIGH 7.6

→ Open the live CVE board · all tools