Vulnerability · Published Sep 16, 2026 · Assigned by Arista
CVE-2026-86106Security Advisory 0179
Critical 9.6
In plain English
A critical-severity missing authentication in VeloCloud Edge from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)0.4%top 70.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | VeloCloud Edge | 1.0.0.0 – before 5.2.0.05.2.0.0 – before 5.2.7.06.1.0.0 – before 6.1.5.06.4.0.0 – before 6.4.2.0 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H