Versa Networks has disclosed three security flaws in the provisioning service built into its VOS appliances, including one that allows an attacker to run commands on the device without any login credentials. The flaws were published on 10 November 2026 and each carries a severity score of 7.6 out of 10.

The most serious of the three is tracked as CVE-2026-107240. It affects the Node.js web service that VOS uses for URL-based Zero Touch Provisioning, the feature that lets an appliance be set up remotely when it is first installed. The service is not needed once provisioning is complete.

How the command injection works

According to the CVE record, the service's /authenticate endpoint passes user-supplied username and password values to a system command through a filter that strips regular expression characters but not newline characters. An attacker can inject a newline character into the username field to run arbitrary shell commands as the versa operating system service user.

No credentials are required. The attacker needs only a cross-site request forgery token, which can be obtained from an unauthenticated page load. That combination makes the flaw reachable by anyone who can reach the provisioning service over the network.

Two more flaws in the same service

The other two flaws sit in the same Node.js service. CVE-2026-107243 concerns the session handling: the service signs session cookies with a hardcoded secret that is identical across all VOS appliances. An attacker who obtains a valid session identifier from any source can compute the correct signature and forge a session cookie that the server accepts as legitimate, and because the secret is shared, a forged cookie is accepted by any VOS appliance in the deployment.

CVE-2026-107244 affects the service's /decryptTest endpoint, which is registered before the session authentication check. It creates an authenticated session whenever it receives a token that decrypts successfully, and because the decryption key and initialisation vector are hardcoded and identical across all appliances, an unauthenticated attacker with network access can compute a valid token and obtain a fully authenticated session without providing any credentials.

What administrators should do

Versa's own security hardening guide for hubs, branches and controllers recommends disabling the Node.js web service after the initial provisioning of a VOS device. None of the three flaws is exploitable on devices where the service has been disabled, so switching it off on appliances that have already been provisioned removes the exposure.

There are no reports of the flaws being exploited in the wild, and none of the three appears in the US CISA Known Exploited Vulnerabilities catalogue. Administrators running VOS, previously known as Versa FlexVNF, should check Versa's security advisory for their deployment and confirm that the provisioning service is disabled on every appliance that no longer needs it.