CVE-2026-86108 – Arista VeloCloud Edge
“When the edge stops checking who's talking, every branch becomes a front door”
Arista Networks' VeloCloud Edge update fixes two serious flaws in the device that links branch sites to the corporate network. CVE-2026-86106 has a CVSS score of 9.6, Critical severity. On Edge units with high availability (HA) enabled, an attacker with network access to the private HA interconnect can trigger sensitive peer functions without authentication and run commands with elevated privileges. CVE-2026-86108 has a CVSS score of 8.0, High severity. Weak input validation in management and configuration workflows lets an authorized request or configuration value run as an operating-system command, which gives the attacker elevated command execution on the device.
Both flaws can give an attacker elevated control of a device that sits on the network perimeter and carries branch traffic. Organizations running VeloCloud Edge should apply this update the same day, starting with HA-enabled deployments.
Key Details
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- High
- User Interaction
- None
- CWE Classification
- CWE-78