23 matches found
CVE-2026-86107
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...
EUVD-2026-80658
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...
CVE-2026-86107 Security Advisory 0180
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...
CVE-2026-86107 Security Advisory 0180
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...
CVE-2026-86107
CVE-2026-86107 is an out-of-bounds write (CWE-787) in the VeloCloud VCMP tunnel protocol on VeloCloud Edge and VeloCloud Gateway (formerly Broadcom). When processing tunneled IP fragments between authenticated overlay neighbors , a malicious peer can trigger a process crash, causing temporary tra...
CVE-2026-86108
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...
CVE-2026-86109
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
EUVD-2026-80093
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
CVE-2026-86109 Security Advisory 0182
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
CVE-2026-86109
Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom) contains a vulnerability in its software update workflow that may accept update bundles without properly validating their signatures. The root cause is that the workflow does not restrict the digest algorithm used for artifact verificati...
CVE-2026-86108 Security Advisory 0181
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...
EUVD-2026-80092
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...
CVE-2026-86108
CVE-2026-86108 is an OS command injection (CWE-78) in Arista VeloCloud Edge (formerly VeloCloud Edge by Broadcom), caused by insufficient validation of inputs in management and configuration workflows. An authorized attacker with a compromised VeloCloud Orchestrator or valid management credential...
CVE-2026-86108 Security Advisory 0181
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...
CVE-2026-86107: Out-of-bounds Write
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and...
PT-2026-93263
Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description The software update workflow fails to properly validate signatures of update bundles because it does not restrict the digest algorithm used for artifact verification. A digest algorith...
CVE-2026-86109: Improper Verification of Cryptographic Signature
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator...
PT-2026-93262
Name of the Vulnerable Software and Affected Versions VeloCloud Edge affected versions not specified Description Insufficient validation of inputs within management and configuration workflows allows an authorized management request or configuration value to be interpreted as an operating-system...
CVE-2026-86108: Improper Neutralization of Special Elements used in an OS Command
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...
Security Advisory 0182
Security Advisory 0182 . CSAF PDF Date: September 9, 2026 Revision | Date | Changes ---|---|--- 1.0 | September 9, 2026 | Initial release 1.1 | September 22, 2026 | CSAF JSON file added The CVE-ID tracking this issue: CVE-2026-86109 CVSSv3.1 Base Score: 6.6...