8.2

CVE-2026-86107

Security Advisory 0180

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.

A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerArista Networks
≫
Produkt VeloCloud
Default Statusunaffected
Version 1.0.0.0
Version < 5.2.0.0
Status affected
Version 5.2.0.0
Version < 5.2.7.0
Status affected
Version 6.1.0.0
Version < 6.1.5.0
Status affected
Version 6.4.0.0
Version < 6.4.2.0
Status affected
HerstellerArista Networks
≫
Produkt VeloCloud Gateway
Default Statusunaffected
Version 1.0.0.0
Version < 5.2.0.0
Status affected
Version 5.2.0.0
Version < 5.2.7.0
Status affected
Version 6.1.0.0
Version < 6.1.5.0
Status affected
Version 6.4.0.0
Version < 6.4.2.0
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.35% 0.288
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
psirt@arista.com 8.2 0 0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
psirt@arista.com 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-787 Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180