# CVE-2026-86107: Arista VeloCloud Edge and Gateway out-of-bounds write in VCMP tunnel

Source: https://junglewise.ai/threats/cve-2026-86107-arista-velocloud-edge-and-gateway-out-of-bounds-write-in-vcmp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-86107 · Severity: medium · CVSS 5.9 · Published 2026-09-16

Arista VeloCloud Edge and Gateway devices, which are used to establish secure network tunnels and manage enterprise SD-WAN infrastructure, contain an out-of-bounds write vulnerability in their VCMP tunnel protocol. An authenticated attacker with an established peer relationship can send specially crafted IP fragments to crash the affected process, causing temporary network disruption until the service restarts. The vulnerability requires authentication and an established tunnel relationship, limiting exposure to trusted networks.

Technologies: [Arista Velocloud Edge](https://junglewise.ai/threats/technologies/velocloud-edge). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-86107 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-86107 being exploited in the wild.

**How severe is CVE-2026-86107?** Medium severity, with a CVSS score of 5.9, published 16 September 2026.

**Which products and versions are affected?** Arista Velocloud Edge 5.2.6.x and below, 6.1.4.x and below, 6.4.1.x and below; Arista Velocloud Gateway 5.2.6.x and below, 6.1.4.x and below, 6.4.1.x and below.

**Is there a fix for CVE-2026-86107?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-86107 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-86107?** Check whether you run Arista Velocloud Edge or Arista Velocloud Gateway at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an out-of-bounds write vulnerability (CWE-787) affecting VeloCloud Edge and Gateway when processing fragmented IP packets over authenticated VCMP tunnels between overlay peers. The root cause lies in improper bounds checking when reassembling tunneled IP fragments. Exploitation requires an authenticated VCMP tunnel to be established with a malicious VeloCloud Edge or Gateway peer, which then sends specifically malformed fragmented packets. A successful exploit causes the edged process (Edge) or gwd process (Gateway) to crash and restart, resulting in temporary traffic disruption. Patches are available in versions 7.0.0 and later, 6.4.2.0+, 6.1.5.0+, and 5.2.7.0+.

## Affected products

- Arista VeloCloud Edge 5.2.6.x and below, 6.1.4.x and below, 6.4.1.x and below
- Arista VeloCloud Gateway 5.2.6.x and below, 6.1.4.x and below, 6.4.1.x and below

## Timeline

- 2026-09-09: disclosed: Security Advisory 0180 published
- 2026-09-16: advisory: CVE-2026-86107 published

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180](https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180)

## Related threats

- [Arista VeloCloud Edge HA authentication bypass](https://junglewise.ai/threats/cve-2026-86106-arista-velocloud-edge-ha-authentication-bypass)
- [Arista VeloCloud Edge signature verification bypass in software update](https://junglewise.ai/threats/cve-2026-86109-arista-velocloud-edge-signature-verification-bypass-in-software)
- [Arista VeloCloud Edge OS command injection in management workflows](https://junglewise.ai/threats/cve-2026-86108-arista-velocloud-edge-os-command-injection-in-management)