Read the docs
TI-2026-58907 Aliases CVE-2026-86107GHSA-wggc-2fwv-g783

Out-of-bounds write in Arista VeloCloud

Priority LOW 36CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Fix Fixed VeloCloud (Arista Networks): 5.2.7.0, 6.1.5.0, 6.4.2.0VeloCloud Gateway (Arista Networks): 5.2.7.0, 6.1.5.0, 6.4.2.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AristaVeloCloud1.0.0.0 to before 5.2.0.0; 5.2.0.0 to before 5.2.7.0; 6.1.0.0 to before 6.1.5.0; 6.4.0.0 to before 6.4.2.05.2.7.0, 6.1.5.0, 6.4.2.0Patch availableCNA
AristaVeloCloud Gateway1.0.0.0 to before 5.2.0.0; 5.2.0.0 to before 5.2.7.0; 6.1.0.0 to before 6.1.5.0; 6.4.0.0 to before 6.4.2.05.2.7.0, 6.1.5.0, 6.4.2.0Patch availableCNA
  • VeloCloud VendorArista Affected 1.0.0.0 to before 5.2.0.0; 5.2.0.0 to before 5.2.7.0; 6.1.0.0 to before 6.1.5.0; 6.4.0.0 to before 6.4.2.0 Fixed in 5.2.7.0, 6.1.5.0, 6.4.2.0 Patch available CNA
  • VeloCloud Gateway VendorArista Affected 1.0.0.0 to before 5.2.0.0; 5.2.0.0 to before 5.2.7.0; 6.1.0.0 to before 6.1.5.0; 6.4.0.0 to before 6.4.2.0 Fixed in 5.2.7.0, 6.1.5.0, 6.4.2.0 Patch available CNA

Remediation

  • Fix · CNA VeloCloud (Arista Networks) Fixed in 5.2.7.0, 6.1.5.0, 6.4.2.0
  • Fix · CNA VeloCloud Gateway (Arista Networks) Fixed in 5.2.7.0, 6.1.5.0, 6.4.2.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-86107
  2. 2026-10-03 Alias added: GHSA-wggc-2fwv-g783

References

Advisory 1

  • TI-2026-79524 Privilege escalation in Arista VeloCloud Orchestrator on-premises KEVCVSS 4.0CRITICAL 9.4
  • TI-2026-63212 Improper input validation in Arista VeloCloud Orchestrator On-Prem KEVCVSS 4.0CRITICAL 9.5
  • TI-2026-13992 VeloCloud Orchestrator OS Command Injection KEVCVSS 4.0CRITICAL 10.0
  • TI-2014-05975 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed… KEVCVSS 3.1CRITICAL 9.8
  • TI-2014-05157 GNU Bash through 4.3 processes trailing strings after function definitions in the values… KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-23989 crypto: algif_aead - Revert to operating out-of-place KEVCVSS 3.1HIGH 7.8
See all 216 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences