VERSA VOS · CVE-2026-107245 · Vendor
FIX → 23.1.x build 2026-08-03 or later · 22.1.x build 2026-07-26 or later ✓ verified
Versa's bulletin: a crafted IKE Auth packet with an oversized Remote ID overflows a stack buffer in VOS (FlexVNF) IPsec and crashes vsmd (denial of service). Versa rates it CRITICAL and says it is aware of malicious IPsec packets from 45.142.193.0/24, 102.135.43.0/24, 102.135.44.0/23, 102.135.46.0/24; it does not say whether any attack succeeded. No public PoC found. Workarounds (Versa): disable the staging VPN profile on Controllers/Hub Controllers when ZTP over Internet is not needed; set a remote peer IP/hostname/FQDN on site-to-site profiles; blackhole the known source IPs.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Versa VOS (FlexVNF) nodes that terminate IPsec on a WAN interface with a controller-staging-sdwan or remote-access-server profile, which typically means Controllers, Hub Controllers and SSE Gateways, plus site-to-site profiles with no remote peer set. Only nodes reachable from the Internet are exposed. Nodes not reachable from the Internet or using an overlay interface as endpoint can skip it.
Not affected if not-internet-reachable, overlay-endpoint, overlay-interface-endpoint
Who cares denial-of-service, flexvnf, internet-facing, ipsec, sd-wan, versa, vos
Versa has confirmed a buffer overflow vulnerability in the IPsec implementation on VOS, aka Versa FlexVNF.
Buffer Overflow Vulnerability Description
When a maliciously crafted IKE Auth packet is sent to VOS, the vsmd process crashes, thereby resulting in a Denial of Service. An attacker can create a Denial-of-Service attack on the VOS appliances by crafting a malicious IKE Auth packet and sending it to the WAN interfaces on the VOS.
During the IKE Authentication phase, if the IKE SA negotiation fails, and the size of the Remote ID is larger than the buffer size used to process the Remote ID, it will result in a crash of the vsmd process on the VOS appliance.
What is impacted?
VOS nodes configured with IPsec VPN profiles of type controller-staging-sdwan or remote-access-server using a WAN interface as the IPsec endpoint are vulnerable. (IPsec profiles configured with an overlay interface as the IPsec endpoint are not affected.) This configuration typically applies to all Controllers, Hub Controllers, and SSE Gateways. Additionally, site-to-site VPN profiles configured without a peer IP address, hostname, or FQDN are also vulnerable.
What is not impacted?
The VOS nodes listed above are not vulnerable if they are not accessible from the Internet.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 23.1.x build 2026-08-03 or later · 22.1.x build 2026-07-26 or later
22.1.2, 22.1.3, 22.1.4) or August 3, 2026 or later (23.1.x); 21.2.3 is end-of-support, move to 22.1.4NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.