CVE-2026-86109: Security Advisory 0182
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Security Advisory 0182 - Compensating control
Restrict access to VeloCloud Orchestrator package upload functionality and to direct Edge access so attackers cannot upload/install unauthorized software.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Organizations using VeloCloud Edge are exposed where an attacker has sufficient privileges to upload packages to VeloCloud Orchestrator or has credentials that permit direct access to an Edge.
What access does an attacker need to exploit the update workflow?
The attacker must either be able to upload update packages through VeloCloud Orchestrator or possess credentials for direct access to a VeloCloud Edge. The issue does not describe exploitation by an unauthenticated attacker.
What is the likely impact of successful exploitation?
A successful attacker may install unauthorized software. The supplied severity vector indicates potential impact to confidentiality, integrity, and availability.