CVE-2026-86108— Security Advisory 0181
Quick assessment
Affected
Arista Networks VeloCloud Edge
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
受影响的 VeloCloud Edge 管理和配置工作流中，由于对输入验证不足，可能导致授权的管理请求或配置值被解释为操作系统命令。成功利用该漏洞可能导致在受影响的 VeloCloud Edge 设备上以提权方式执行命令。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86108
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Security Advisory 0181
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Arista Networks | VeloCloud Edge | 6.4.0 ~ 6.4.1.x | - |
|
II. Public POCs for CVE-2026-86108
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86108
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-86108 (1)
-
Security Advisory 0181 - Arista vendor-advisory
Same Patch Batch · Arista Networks · 2026-09-16 · 3 CVEs total
| CVE-2026-73450 | 6.9 MEDIUM | Security Advisory 0161 |
| CVE-2026-86109 | 6.6 MEDIUM | Security Advisory 0182 |
IV. Related Vulnerabilities
Same product: VeloCloud Edge
Same weakness: CWE-78
-
CVE-2026-10144
Rsbuild < 2.0.9 Command Injection via openBrowser() URL Hand -
CVE-2026-58502
githubtoplanguages: Command Injection via Issue Title in Dis -
CVE-2026-91853
TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os comman -
CVE-2026-91936
Flowise before 3.1.4 Script Injection via Docker Workflows -
CVE-2026-91931
Flowise before 3.1.4 Remote Code Execution via Custom MCP np
V. Comments for CVE-2026-86108
No comments yet