Vulnerability · Published Sep 16, 2026 · Assigned by Arista
CVE-2026-86108Security Advisory 0181
High 8.0
In plain English
A high-severity OS command injection in VeloCloud Edge from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.6%top 50.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | VeloCloud Edge | 6.4.0 – through 6.4.1.x6.1.0 – through 6.1.4.x5.2.0 – through 5.2.6.x0.0.0 – before 5.2.0 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- Security Advisory 0181 vendor-advisory