CVE-2026-86109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86109", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-05T01:54:43.258Z", "datePublished": "2026-09-16T02:57:46.285Z", "dateUpdated": "2026-09-17T17:40:35.095Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-16T02:57:46.285Z"}, "title": "Security Advisory 0182", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-206", "descriptions": [{"lang": "en", "value": "CAPEC-206 Signing Malicious Code"}]}], "affected": [{"vendor": "Arista Networks", "product": "VeloCloud Edge", "versions": [{"status": "affected", "version": "6.4.0", "lessThanOrEqual": "6.4.1.x", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThanOrEqual": "6.1.4.x", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThanOrEqual": "5.2.6.x", "versionType": "custom"}, {"status": "affected", "version": "0.0.0", "lessThan": "5.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.</p>"}]}], "references": [{"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182", "name": "Security Advisory 0182", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.</p>"}]}], "workarounds": [{"lang": "en", "value": "1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \n2. Protect VeloCloud Orchestrator administrative credentials and management access. \n3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \n4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. <br>2. Protect VeloCloud Orchestrator administrative credentials and management access. <br>3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. <br>4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.</p>"}]}], "solutions": [{"lang": "en", "value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.</p>"}]}], "credits": [{"lang": "en", "value": "This issue was discovered internally by Arista. Arista is not aware of any malicious exploitation of this vulnerability in customer networks.", "type": "finder"}], "source": {"advisory": "0182", "discovery": "UNKNOWN", "defects": ["BUG1833886"]}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-17T17:40:03.578525Z", "id": "CVE-2026-86109", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T17:40:35.095Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86109", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-09-05T01:54:43.258Z", "datePublished": "2026-09-16T02:57:46.285Z", "dateUpdated": "2026-09-17T17:40:35.095Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-16T02:57:46.285Z"}, "title": "Security Advisory 0182", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-206", "descriptions": [{"lang": "en", "value": "CAPEC-206 Signing Malicious Code"}]}], "affected": [{"vendor": "Arista Networks", "product": "VeloCloud Edge", "versions": [{"status": "affected", "version": "6.4.0", "lessThanOrEqual": "6.4.1.x", "versionType": "custom"}, {"status": "affected", "version": "6.1.0", "lessThanOrEqual": "6.1.4.x", "versionType": "custom"}, {"status": "affected", "version": "5.2.0", "lessThanOrEqual": "5.2.6.x", "versionType": "custom"}, {"status": "affected", "version": "0.0.0", "lessThan": "5.2.0", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.</p>"}]}], "references": [{"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182", "name": "Security Advisory 0182", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "configurations": [{"lang": "en", "value": "Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.</p>"}]}], "workarounds": [{"lang": "en", "value": "1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \n2. Protect VeloCloud Orchestrator administrative credentials and management access. \n3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \n4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. <br>2. Protect VeloCloud Orchestrator administrative credentials and management access. <br>3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. <br>4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.</p>"}]}], "solutions": [{"lang": "en", "value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.</p>"}]}], "credits": [{"lang": "en", "value": "This issue was discovered internally by Arista. Arista is not aware of any malicious exploitation of this vulnerability in customer networks.", "type": "finder"}], "source": {"advisory": "0182", "discovery": "UNKNOWN", "defects": ["BUG1833886"]}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86109", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-17T17:40:03.578525Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T17:40:29.499Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "VeloCloud Edge", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "6.4.1.x", "status": "affected", "version": "6.4.0", "versionType": "custom"}, {"lessThanOrEqual": "6.1.4.x", "status": "affected", "version": "6.1.0", "versionType": "custom"}, {"lessThanOrEqual": "5.2.6.x", "status": "affected", "version": "5.2.0", "versionType": "custom"}, {"lessThan": "5.2.0", "status": "affected", "version": "0.0.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software."}], "id": "CVE-2026-86109", "lastModified": "2026-09-17T18:17:12.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86109", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-17T17:40:03.578525Z", "version": "2.0.3"}}]}, "published": "2026-09-16T03:17:00.250", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-347"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.4.0,6.4.1.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[6.1.0,6.1.4.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.2.0,5.2.6.x]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0.0.0,5.2.0)"}}], "enrichment": {"confidence": 82.0, "confidence_source": "matching", "scores": [{"score": 82.0, "source": "matching"}]}, "original": {"product": "VeloCloud Edge", "source": "cna", "vendor": "Arista Networks"}, "product": "velocloud_edge", "vendor": "arista"}], "created": "2026-09-16T17:45:17.536570+00:00", "title": "Unrestricted Artifact Verification Enables Unauthorized Software Installation in VeloCloud Edge", "updated": "2026-09-29T13:15:04.573881+00:00", "vendors": ["arista", "arista$PRODUCT$velocloud_edge"]}