Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86106

Security Advisory 0179

CVSS 3.1 9.6 CRITICALCVSS 4.0 8.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86106

Published

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86106

Published

VeloCloud Edge

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Arista Networks",
                    "product": "VeloCloud Edge",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "1.0.0.0",
                            "lessThan": "5.2.0.0",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "5.2.0.0",
                            "lessThan": "5.2.7.0",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "6.1.0.0",
                            "lessThan": "6.1.5.0",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "6.4.0.0",
                            "lessThan": "6.4.2.0",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ],
                    "platforms": [
                        "VeloCloud Edge"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON