Versa VOS: one oversized Remote ID in an IKE Auth packet crashes vsmd on internet-facing Controllers, Hub Controllers and SSE Gateways (CVE-2026-107245)

official (CVE-2026-107245 record, published Nov 10, 2026 00:32 UTC, with Versa's advisory text; Versa bulletin is behind its customer portal); no CVSS yet; the advisory's workaround mentions blocking source IPs of exploitation attempts but does not describe the scale of any activity2026-11-09

Versa VOS: one oversized Remote ID in an IKE Auth packet crashes vsmd on internet-facing Controllers, Hub Controllers and SSE Gateways (CVE-2026-107245)

Workarounds from the advisory: disable the staging VPN profile on Controllers and Hub Controllers except while bootstrapping devices with internet ZTP; set a remote peer IP, hostname or FQDN on every site-to-site profile; blackhole source IPs seen sending the malicious packets.
Affected trains: 21.1.1 to 21.2.3, 22.1.2 to 22.1.4 before the July 2, 2026 hotfix, and 23.1.2 before the Aug 3, 2026 hotfix.
SD-WAN controllers are high-value edge devices; even a crash-only bug can cut off every branch that depends on them.

Sources: CVE-2026-107245 record (CVE.org): Versa VOS IPsec IKE Auth buffer overflow · Versa Networks security bulletin (customer portal)