by Kastro
Paper/Archive/CVE-2026-86106

CVE-2026-86106

Arista Networks VeloCloud Edge — Security Advisory 0179

EPSS 0.4%CVSS 9.6
critical.is priorityof 100
35
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 29.3.293 × 205.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

Affected

ProductAffectedFixed inSource
VeloCloud Edge1.0.0.0 – < 5.2.0.05.2.0.0CNA
VeloCloud Edge5.2.0.0 – < 5.2.7.05.2.7.0CNA
VeloCloud Edge6.1.0.0 – < 6.1.5.06.1.5.0CNA
VeloCloud Edge6.4.0.0 – < 6.4.2.06.4.2.0CNA

Scores by source

Arista (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Arista (CNA)8.7CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryarista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179