CVE-2026-86109

MediumCVSS 6.6

Published: 16/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 16/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because it does not restrict the digest algorithm used for artifact verification. An attacker with sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

Risk Assessment

The ability to install unauthorized software on Edge devices poses a risk of compromising network infrastructure, including deployment of malicious code or backdoors. However, it requires prior privileges to the Orchestrator or Edge.

Recommendation

Restrict permissions for uploading update packages in VeloCloud Orchestrator and secure access to Edge devices. Monitor vendor updates and apply the patch when available.

Other vulnerabilities in VeloCloud Edge

CVE-2026-86108High
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.

Original NVD description (English source)

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS