What’s Vulnerable › Vulnerabilities
CVE-2026-86109: Security Advisory 0182
- Severity: medium (CVSS 6.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-16 · updated 2026-09-17
- Weakness: CWE-347
Description
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Affected products
- Arista Networks VeloCloud Edge: from 6.4.0 through 6.4.1.x; from 6.1.0 through 6.1.4.x; from 5.2.0 through 5.2.6.x; before 5.2.0 — fixed in 5.2.0
How to fix
Upgrade to a fixed version: Arista Networks VeloCloud Edge 5.2.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86109 or the next vulnerability affects your stack