CVE-2026-86108

HighCVSS 8.0/10Last modified Sep 17, 2026

Description

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Arista Networks	VeloCloud Edge	>= 6.4.0, <= 6.4.1.x; >= 6.1.0, <= 6.1.4.x; >= 5.2.0, <= 5.2.6.x; >= 0.0.0, < 5.2.0

References

https://www.arista.com/zh/support/advisories-notices/security-advisory/24737-security-advisory-0181

Timeline

Published: Sep 16, 2026
Last modified: Sep 17, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-861096.6The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does CVE-2026-86114.3The Klamra Paycal for Aspaclaria plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including CVE-2026-861116.5BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read f CVE-2026-861125.4BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers CVE-2026-861136.5BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to mo CVE-2026-861146.5Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delet CVE-2026-861155.0Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation a CVE-2026-861166.5Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to CVE-2026-861178.1Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts CVE-2026-861184.3gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger CVE-2026-861198.6Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asse CVE-2026-86125.3WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local r