# CVE-2026-107245: CVE-2026-107245

Status: published. Published: 2026-11-10. Updated: 2026-11-10.

Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF. 
 
 Buffer Overflow Vulnerability Description 
 
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS. 
 
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance. 
 
What is impacted? 
 
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable. 
 
What is not impacted?  
 
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.

## Remediation

- workaround: Disable the staging VPN profile on Controllers and Hub Controllers when Zero-Touch Provisioning (ZTP) over the Internet is not actively required. Enable the profile only for the duration of device bootstrapping. 

For site-to-site IPsec VPN profiles without a configured remote peer, specify the remote peer IP address, hostname, or fully qualified domain name (FQDN). 

If the source IP address associated with exploitation attempts is known, configure a discard or blackhole route for that IP address to block the malicious traffic. (source: CNA: hackerone)

## Affected products and versions

- Versa / VOS: ≥ 21.1.1; ≤ 21.2.3 (affected, semver); ≥ 22.1.2; < July 2, 2026 (affected, semver); ≥ 22.1.3; < July 2, 2026 (affected, semver); ≥ 22.1.4; < July 2, 2026 (affected, semver); ≥ 23.1.2; < 23.1.2 (affected, semver); ≥ 22.1.2 July-2-2026-Hotfix; < 22.1.2 July-2-2026-Hotfix (unaffected, semver); ≥ 22.1.3 July-2-2026-Hotfix; < 22.1.3 July-2-2026-Hotfix (unaffected, semver); ≥ 22.1.4 July-2-2026-Hotfix; < 22.1.4 July-2-2026-Hotfix (unaffected, semver); ≥ 23.1.2 Aug-3-2026-Hotfix; < 23.1.2 Aug-3-2026-Hotfix (unaffected, semver). Source: CNA: hackerone

## Severity and prioritization

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-121

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://security-portal.versa-networks.com/emailbulletins/6a663c9aabeebad826bc8d29 (CNA: hackerone)

## Provenance

- CNA: hackerone: https://www.cve.org/CVERecord?id=CVE-2026-107245; retrieved 2026-11-10; source updated 2026-11-10

Revision: 8fc63e6718d443805a7b2b86bf412321462623c32a33ee8b4f584e09cc9d33aa

Canonical: https://y2.dev/cve/CVE-2026-107245

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.