Arista Networks
Vulnerability activity for Arista Networks: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 1
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 90 days
- CVEs
- 70
- Critical (CVSS 9+)
- 8
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Last 365 days
- CVEs
- 70
- Critical (CVSS 9+)
- 8
- Exploited (CISA KEV)
- 1
- With exploit code
- 1
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
Recent
- 9.9CriticalOct 22, 2026Arista Networks VeloCloud Orchestrator SQL injectionCVE-2026-114625VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intendeExploitedExploit code
- 6.5MediumOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102169On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
- 6.5MediumOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102168On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.
- 7.5HighOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102167On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
- 7.5HighOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102165On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.
- 3.1LowOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102164On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
- 8.8HighOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102163On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.
- 8.8HighOct 6, 2026Arista Networks Wi-Fi Access Points Memory corruptionCVE-2026-102162On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
- 8.8HighOct 6, 2026Arista Networks CloudVision CUE Auth bypass / access controlCVE-2026-102161An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
- 7.2HighOct 6, 2026Arista Networks CloudVision CUE Code / command injectionCVE-2026-102160An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.1.4% likely
- 9.8CriticalOct 6, 2026Arista Networks CloudVision CUE Auth bypass / access controlCVE-2026-102159An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
- 6.5MediumOct 6, 2026Arista Networks CloudVision CUE Code / command injectionCVE-2026-102158Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.
- 5.9MediumOct 6, 2026Arista Networks CloudVision CUE Auth bypass / access controlCVE-2026-102157An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
- 6.8MediumOct 6, 2026Arista Networks CloudVision CUE Code / command injectionCVE-2026-102156Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
- 8.5HighOct 6, 2026Arista Networks CloudVision CUE Denial of serviceCVE-2026-102155An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.
- 8.4HighOct 6, 2026Arista Networks CloudVision Portal XSSCVE-2026-101158A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.
- 8.7HighOct 6, 2026Arista Networks CloudVision CUE XSSCVE-2026-101157A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.
- 8.4HighOct 6, 2026Arista Networks CloudVision CUE XSSCVE-2026-101156A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
- 9.1CriticalOct 6, 2026Arista Networks CloudVision Portal Path traversal / file handlingCVE-2026-101155An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
- 7.2HighOct 6, 2026Arista Networks CloudVision Portal Path traversal / file handlingCVE-2026-101154An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.
- 8.0HighOct 6, 2026Arista Networks CloudVision Portal Path traversal / file handlingCVE-2026-101153On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
- 8.0HighOct 6, 2026Arista Networks CloudVision PortalCVE-2026-101152Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.
- 4.3MediumOct 6, 2026Arista Networks CloudVision PortalCVE-2026-101151Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.
- 4.1MediumOct 6, 2026Arista Networks CloudVision Portal SSRFCVE-2026-101150Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- 4.1MediumOct 6, 2026Arista Networks CloudVision Portal SSRFCVE-2026-101149Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- 6.5MediumSep 16, 2026Arista Networks EOS Memory corruptionCVE-2026-73462On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploit
- 5.3MediumSep 16, 2026Arista Networks EOS Information disclosureCVE-2026-73457Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.
- 10.0CriticalSep 16, 2026Arista Networks EOS Code / command injectionCVE-2026-73456Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
- 4.7MediumSep 16, 2026Arista Networks EOS Auth bypass / access controlCVE-2026-73443On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using th
- 3.0LowSep 16, 2026Arista Networks EOS Information disclosureCVE-2026-73442On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.
- 5.9MediumSep 16, 2026Arista Networks VeloCloud Memory corruptionCVE-2026-86107The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
- 9.6CriticalSep 16, 2026Arista Networks VeloCloud Edge Auth bypass / access controlCVE-2026-86106An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
- 6.5MediumSep 16, 2026Arista Networks EOSCVE-2026-77190On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
- 5.8MediumSep 16, 2026Arista Networks EOS Auth bypass / access controlCVE-2026-73469When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
- 6.5MediumSep 16, 2026Arista Networks EOSCVE-2026-73468A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
- 7.5HighSep 16, 2026Arista Networks EOSCVE-2026-73455On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
- 10.0CriticalSep 16, 2026Arista Networks EOS Code / command injectionCVE-2026-73453An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch. This issue was discovered internally by Arista, and the company
- 4.2MediumSep 16, 2026Arista Networks EOSCVE-2026-73440On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS). This issue was discove
- 5.3MediumSep 16, 2026Arista Networks EOSCVE-2026-73438On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. This issue was reported externally by Dravanet Inc., and Arista is not aw
- 6.5MediumSep 16, 2026Arista Networks EOS Memory corruptionCVE-2026-73436On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
- 8.2HighSep 16, 2026Arista Networks EOS Auth bypass / access controlCVE-2026-73435On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
- 4.2MediumSep 16, 2026Arista Networks EOS Auth bypass / access controlCVE-2026-19640On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
- 8.8HighSep 16, 2026Arista Networks EOS Code / command injectionCVE-2026-73464On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.
- 5.3MediumSep 16, 2026Arista Networks EOSCVE-2026-73463On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer net
- 8.0HighSep 16, 2026Arista Networks EOS Privilege escalationCVE-2026-73461On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.
- 8.1HighSep 16, 2026Arista Networks EOS Code / command injectionCVE-2026-73454On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.
- 4.9MediumSep 16, 2026Arista Networks EOSCVE-2026-73445On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
- 7.5HighSep 16, 2026Arista Networks EOSCVE-2026-73439On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to
- 7.4HighSep 16, 2026Arista Networks EOSCVE-2026-2380On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive O
- 9.1CriticalSep 16, 2026Arista Networks EOS Code / command injectionCVE-2026-73447A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
Top products
- EOS41 CVEs in the last year, 4 critical
- CloudVision CUE9 CVEs in the last year, 1 critical
- CloudVision Portal8 CVEs in the last year, 1 critical
- Wi-Fi Access Points7 CVEs in the last year
- VeloCloud Edge3 CVEs in the last year, 1 critical
- VeloCloud Orchestrator1 CVE in the last year, 1 critical, 1 exploited
- VeloCloud1 CVE in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- CCCS (Canada) · Oct 23, 2026Arista Networks security advisory (AV26-1080)CVE-2026-114625
- CISA · Oct 23, 2026CISA Adds One Known Exploited Vulnerability to CatalogCVE-2026-114625
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.