Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-86109

Security Advisory 0182

CVSS 3.1 6.6 MEDIUMCVSS 4.0 7.5 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-86109

Published

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-86109

Published

VeloCloud Edge

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Arista Networks",
                    "product": "VeloCloud Edge",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "6.4.0",
                            "lessThanOrEqual": "6.4.1.x",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "6.1.0",
                            "lessThanOrEqual": "6.1.4.x",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "5.2.0",
                            "lessThanOrEqual": "5.2.6.x",
                            "versionType": "custom"
                        },
                        {
                            "status": "affected",
                            "version": "0.0.0",
                            "lessThan": "5.2.0",
                            "versionType": "custom"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON