VeloCloud Edge CVE-2026-86106

Exploitation requires (1) High Availability (HA) explicitly enabled on the VeloCloud Edge units, and (2) network access to the private HA interconnect - the dedicated link/segment carrying peer synchronization traffic between the paired Edge appliances. The vulnerable HA peer functions perform no caller verification, so once an attacker can place traffic on that interconnect no credentials are needed (PR:N). Limiting factors: the AV:A adjacency means the attacker must be on the HA interconnect broadcast/segment rather than reaching it over the routed internet, and units without HA configured are not affected; well-segmented or physically isolated HA links substantially reduce reachability.

The CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N) reflects an unauthenticated (PR:N), low-complexity flaw yielding full confidentiality, integrity and availability impact via elevated command execution - but the single most important limiter is AV:A (adjacent), because the vulnerable functions are exposed only on the private HA interconnect, not the public network. This is a genuine missing-authentication issue (CWE-306) confirmed and patched by the vendor (Arista), so it is a real priority for shops running VeloCloud Edge in HA pairs. However, no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation; the practical risk hinges on whether an attacker can reach the HA interconnect segment, which in well-segmented deployments is an isolated back-to-back or dedicated link. Net: high technical severity but meaningfully gated real-world reachability - treat as an important patch for HA-enabled units rather than an internet-facing emergency. No conflicting signals in the data, though the adjacency requirement should temper the 8.7 headline number for teams that isolate their HA links.

An attacker who has gained a foothold on, or the ability to inject traffic onto, the private HA interconnect segment between two VeloCloud Edge units sends crafted requests to the HA peer functions, which perform no verification of the caller. Because these functions execute privileged operations, the attacker achieves elevated command execution on the Edge appliance. No public exploit code is identified at time of analysis, and the attack requires adjacency to the HA link rather than remote internet access.