Vulnerability · Published Sep 16, 2026 · Assigned by Arista

CVE-2026-86109Security Advisory 0182

Medium 6.6

In plain English

A medium-severity security flaw in VeloCloud Edge from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)6.6Medium

Exploit odds (30 days)0.2%top 84.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

Affected products (as reported)

Vendor	Product	Versions
Arista Networks	VeloCloud Edge	6.4.0 – through 6.4.1.x6.1.0 – through 6.1.4.x5.2.0 – through 5.2.6.x0.0.0 – before 5.2.0

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Security Advisory 0182 vendor-advisory