Threats Tagged 'ghsa-gqff-2qm6-5664'

CVE-2026-86109 is a vulnerability in Arista Networks VeloCloud Edge where the software update workflow does not properly verify cryptographic signatures. This occurs because the update process does not restrict the digest algorithm used for verifying update bundles. An attacker with sufficient privileges to upload packages or access the Edge device could install unauthorized software. The vulnerability affects multiple versions of VeloCloud Edge up to 6.4.1.x. The CVSS score is 6.6, indicating a medium severity level.