What is CVE-2026-86106?

CVE-2026-86106 is a critical-severity vulnerability in Arista Networks Velocloud Edge, classified under Missing Authentication for Critical Function. CVSS score: 9.6/10. Published 2026-09-16.

How severe is CVE-2026-86106?

Critical severity. CVSS v3 base score is 9.6 out of 10.

Auth bypass in Arista Networks Velocloud Edge

CVE-2026-86106

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

Vulnerability class: Broken Authentication

CVSS v3 metric

CVSS v3 base score 9.6 (Critical). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Arista Networks Velocloud Edge

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

psirt@arista.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-86106?: CVE-2026-86106 is a critical-severity vulnerability in Arista Networks Velocloud Edge, classified under Missing Authentication for Critical Function. CVSS score: 9.6/10. Published 2026-09-16.
How severe is CVE-2026-86106?: Critical severity. CVSS v3 base score is 9.6 out of 10.