Arista
Vulnerability activity for Arista: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 1
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Last 365 days
- CVEs
- 3
- Critical (CVSS 9+)
- 2
- Exploited (CISA KEV)
- 3
- With exploit code
- 0
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 10.0CriticalSep 22, 2026Arista VeloCloud OrchestratorCVE-2026-93952Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.Added to KEV Sep 22, 2026Exploited1.1% likely
- 10.0CriticalJul 27, 2026Arista VeloCloud Orchestrator Code / command injectionCVE-2026-16812Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.Added to KEV Jul 27, 2026Exploited1% likely
- 5.8MediumJun 9, 2026Arista Extensible Operating SystemCVE-2026-7473Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.Added to KEV Jun 9, 2026Exploited1.1% likely
Recent
- 10.0CriticalSep 22, 2026Arista VeloCloud OrchestratorCVE-2026-93952Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.Exploited1.1% likely
- 10.0CriticalJul 27, 2026Arista VeloCloud Orchestrator Code / command injectionCVE-2026-16812Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.Exploited1% likely
- 5.8MediumJun 9, 2026Arista Extensible Operating SystemCVE-2026-7473Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.Exploited1.1% likely
Top products
- VeloCloud Orchestrator2 CVEs in the last year, 2 critical, 2 exploited
- Extensible Operating System1 CVE in the last year, 1 exploited
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.