Search
Find a vulnerability
Search criteria
6 vulnerabilities found for VeloCloud Edge by Arista Networks
CVE-2026-86106 (GCVE-0-2026-86106)
Vulnerability from nvd – Published: 2026-09-16 10:12 – Updated: 2026-09-16 17:53
VLAI
EPSS
VEX
Title
Security Advisory 0179
Summary
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:52 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
1.0.0.0 , < 5.2.0.0
(custom)
Affected: 5.2.0.0 , < 5.2.7.0 (custom) Affected: 6.1.0.0 , < 6.1.5.0 (custom) Affected: 6.4.0.0 , < 6.4.2.0 (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:52:49.256029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:53:47.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Edge"
],
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.0.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.7.0",
"status": "affected",
"version": "5.2.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.5.0",
"status": "affected",
"version": "6.1.0.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect.\u003c/p\u003e"
}
],
"value": "The vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.\u003c/p\u003e"
}
],
"value": "An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:25:43.381Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following VeloCloud Edge releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e5.2.7.0 and later in the 5.2.x train\u003c/li\u003e\n\u003cli\u003e6.1.5.0 and later in the 6.1.x train\u003c/li\u003e\n\u003cli\u003e6.4.2 and later in the 6.4.x train\u003c/li\u003e\n\u003cli\u003e7.0.0 and later\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNo hotfixes are available for this issue.\u003c/p\u003e"
}
],
"value": "The following VeloCloud Edge releases contain the fix:\n- 5.2.7.0 and later in the 5.2.x train\n- 6.1.5.0 and later in the 6.1.x train\n- 6.4.2 and later in the 6.4.x train\n- 7.0.0 and later\n\nNo hotfixes are available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0179",
"defects": [
"BUG1833882"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0179",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces.\u003c/p\u003e"
}
],
"value": "Use dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86106",
"datePublished": "2026-09-16T10:12:55.587Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-16T17:53:47.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86109 (GCVE-0-2026-86109)
Vulnerability from nvd – Published: 2026-09-16 02:57 – Updated: 2026-09-17 17:40
VLAI
EPSS
VEX
Title
Security Advisory 0182
Summary
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:03.578525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:40:35.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.\u003c/p\u003e"
}
],
"value": "Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista. Arista is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.\u003c/p\u003e"
}
],
"value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software."
}
],
"impacts": [
{
"capecId": "CAPEC-206",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-206 Signing Malicious Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:57:46.285Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0182",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0182",
"defects": [
"BUG1833886"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0182",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \u003cbr\u003e2. Protect VeloCloud Orchestrator administrative credentials and management access. \u003cbr\u003e3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \u003cbr\u003e4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.\u003c/p\u003e"
}
],
"value": "1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \n2. Protect VeloCloud Orchestrator administrative credentials and management access. \n3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \n4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86109",
"datePublished": "2026-09-16T02:57:46.285Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:40:35.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86108 (GCVE-0-2026-86108)
Vulnerability from nvd – Published: 2026-09-16 02:50 – Updated: 2026-09-17 17:41
VLAI
EPSS
VEX
Title
Security Advisory 0181
Summary
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:53.450896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:41:11.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface.\u003c/p\u003e"
}
],
"value": "To successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.\u003c/p\u003e"
}
],
"value": "Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:50:07.219Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0181",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24737-security-advisory-0181"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0181",
"defects": [
"BUG1857467",
"BUG1833895",
"BUG1833902",
"BUG1833887"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0181",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \u003cbr\u003e2. Protect Orchestrator administrative credentials and management access. \u003cbr\u003e3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel.\u003c/p\u003e"
}
],
"value": "1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \n2. Protect Orchestrator administrative credentials and management access. \n3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86108",
"datePublished": "2026-09-16T02:50:07.219Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:41:11.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86106 (GCVE-0-2026-86106)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:12 – Updated: 2026-09-16 17:53
VLAI
EPSS
VEX
Title
Security Advisory 0179
Summary
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:52 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
1.0.0.0 , < 5.2.0.0
(custom)
Affected: 5.2.0.0 , < 5.2.7.0 (custom) Affected: 6.1.0.0 , < 6.1.5.0 (custom) Affected: 6.4.0.0 , < 6.4.2.0 (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:52:49.256029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:53:47.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Edge"
],
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.0.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.7.0",
"status": "affected",
"version": "5.2.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.5.0",
"status": "affected",
"version": "6.1.0.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect.\u003c/p\u003e"
}
],
"value": "The vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.\u003c/p\u003e"
}
],
"value": "An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:25:43.381Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following VeloCloud Edge releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e5.2.7.0 and later in the 5.2.x train\u003c/li\u003e\n\u003cli\u003e6.1.5.0 and later in the 6.1.x train\u003c/li\u003e\n\u003cli\u003e6.4.2 and later in the 6.4.x train\u003c/li\u003e\n\u003cli\u003e7.0.0 and later\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNo hotfixes are available for this issue.\u003c/p\u003e"
}
],
"value": "The following VeloCloud Edge releases contain the fix:\n- 5.2.7.0 and later in the 5.2.x train\n- 6.1.5.0 and later in the 6.1.x train\n- 6.4.2 and later in the 6.4.x train\n- 7.0.0 and later\n\nNo hotfixes are available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0179",
"defects": [
"BUG1833882"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0179",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces.\u003c/p\u003e"
}
],
"value": "Use dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86106",
"datePublished": "2026-09-16T10:12:55.587Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-16T17:53:47.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86109 (GCVE-0-2026-86109)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:57 – Updated: 2026-09-17 17:40
VLAI
EPSS
VEX
Title
Security Advisory 0182
Summary
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:03.578525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:40:35.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.\u003c/p\u003e"
}
],
"value": "Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista. Arista is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.\u003c/p\u003e"
}
],
"value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software."
}
],
"impacts": [
{
"capecId": "CAPEC-206",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-206 Signing Malicious Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:57:46.285Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0182",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0182",
"defects": [
"BUG1833886"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0182",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \u003cbr\u003e2. Protect VeloCloud Orchestrator administrative credentials and management access. \u003cbr\u003e3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \u003cbr\u003e4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.\u003c/p\u003e"
}
],
"value": "1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \n2. Protect VeloCloud Orchestrator administrative credentials and management access. \n3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \n4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86109",
"datePublished": "2026-09-16T02:57:46.285Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:40:35.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86108 (GCVE-0-2026-86108)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:50 – Updated: 2026-09-17 17:41
VLAI
EPSS
VEX
Title
Security Advisory 0181
Summary
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:53.450896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:41:11.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface.\u003c/p\u003e"
}
],
"value": "To successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.\u003c/p\u003e"
}
],
"value": "Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:50:07.219Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0181",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24737-security-advisory-0181"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0181",
"defects": [
"BUG1857467",
"BUG1833895",
"BUG1833902",
"BUG1833887"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0181",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \u003cbr\u003e2. Protect Orchestrator administrative credentials and management access. \u003cbr\u003e3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel.\u003c/p\u003e"
}
],
"value": "1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \n2. Protect Orchestrator administrative credentials and management access. \n3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86108",
"datePublished": "2026-09-16T02:50:07.219Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:41:11.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}