MEDIUM
CVE-2026-86109
CVSS
6.6
Description
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Weakness (CWE)
CWE-347
Improper Signature Verification
EPSS Score
0.24%
Probability of exploitation in next 30 days
15.8th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.