What’s Vulnerable › Vulnerabilities
CVE-2026-86106: Security Advisory 0179
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-16
- Weakness: CWE-306
Description
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
Affected products
- Arista Networks VeloCloud Edge: from 1.0.0.0 before 5.2.0.0; from 5.2.0.0 before 5.2.7.0; from 6.1.0.0 before 6.1.5.0; from 6.4.0.0 before 6.4.2.0 — fixed in 5.2.0.0, 5.2.7.0, 6.1.5.0, 6.4.2.0
How to fix
Upgrade to a fixed version: Arista Networks VeloCloud Edge 5.2.0.0, 5.2.7.0, 6.1.5.0, 6.4.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86106 or the next vulnerability affects your stack