CVE-2026-86109CWE-347

CVE-2026-86109

Medium · published September 16, 2026

CVSS v3.1
6.6
EPSS
0%
Percentile
14.6
In the wild
Unconfirmed
What it is

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
7.5 · CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00243 · 14.6th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-09-16T07:17Z
References (1)
https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 0%
    epss
  • 16 SEP 02:57Z
    Security Advisory 0182
    cvelistv5