Medium severity6.6NVD Advisory· Published Sep 16, 2026

CVE-2026-86109

Description

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

VeloCloud/Edgellm-create

Patches

Vulnerability mechanics

References

www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182nvd

News mentions

No linked articles in our index yet.

cvss	0.429
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000