CVE-2026-86108 Security Advisory 0181
An attacker with management access can execute arbitrary OS commands with elevated privileges on VeloCloud Edge devices due to insufficient input validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-86108?
CVE-2026-86108 is a high-severity command injection vulnerability in Arista Networks VeloCloud Edge, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Weakness: CWE-78
Which versions are affected by CVE-2026-86108?
How do I fix CVE-2026-86108?
No fix has been published for CVE-2026-86108 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-86108 being exploited?
There is no known exploitation of CVE-2026-86108 in the wild and no public exploit code.
Sources
Also known as GHSA-x5pp-fh4g-xqcc.