# CVE-2026-86106: Arista VeloCloud Edge HA authentication bypass

Source: https://junglewise.ai/threats/cve-2026-86106-arista-velocloud-edge-ha-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86106 · Severity: critical · CVSS 9.6 · Published 2026-09-16

Arista VeloCloud Edge is a widely deployed edge networking device used to manage secure WAN connections and branch office traffic. An unauthenticated attacker with access to the internal HA (High Availability) network can execute arbitrary commands with elevated privileges on affected Edge units, potentially taking control of critical network infrastructure and gaining access to sensitive traffic flowing through the device.

Technologies: [Arista Velocloud Edge](https://junglewise.ai/threats/technologies/velocloud-edge). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-86106 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86106 being exploited in the wild.

**How severe is CVE-2026-86106?** Critical severity, with a CVSS score of 9.6, published 16 September 2026.

**Which products and versions are affected?** Arista Velocloud Edge 6.4.1.x and below, 6.1.4.x and below, 5.2.6.x and below, and all prior releases.

**Is there a fix for CVE-2026-86106?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86106 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-86106?** Check whether you run Arista Velocloud Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is a missing authentication vulnerability (CWE-306) in the HA peer communication protocol on VeloCloud Edge devices. An unauthenticated actor with Layer 2 network access to the dedicated HA interconnect can trigger sensitive HA peer functions without verification, bypassing authentication controls. The attack is feasible when HA is enabled and the HA connection is extended through shared switches or VLANs rather than direct port-to-port connections. Successful exploitation results in elevated command execution on the Edge unit, allowing complete device compromise. The vulnerability affects VeloCloud Edge versions 6.4.1.x and below, 6.1.4.x and below, 5.2.6.x and below, and all earlier releases; patches are available in 7.0.0 and later, 6.4.2 and later, 6.1.5.0 and later, and 5.2.7.0 and later.

## Affected products

- Arista VeloCloud Edge 6.4.1.x and below, 6.1.4.x and below, 5.2.6.x and below, and all prior releases

## Timeline

- 2026-09-09: disclosed: Security Advisory 0179 released
- 2026-09-16: advisory: CVE-2026-86106 published to NVD

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179](https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179)

## Related threats

- [Arista VeloCloud Edge and Gateway out-of-bounds write in VCMP tunnel](https://junglewise.ai/threats/cve-2026-86107-arista-velocloud-edge-and-gateway-out-of-bounds-write-in-vcmp)
- [Arista VeloCloud Edge signature verification bypass in software update](https://junglewise.ai/threats/cve-2026-86109-arista-velocloud-edge-signature-verification-bypass-in-software)
- [Arista VeloCloud Edge OS command injection in management workflows](https://junglewise.ai/threats/cve-2026-86108-arista-velocloud-edge-os-command-injection-in-management)