CVE-2026-86106CWE-306

CVE-2026-86106

Critical · published September 16, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00356 · 28.1th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-09-16T15:16Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179 · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 16 SEP 10:12Z
    Security Advisory 0179
    cvelistv5