Arista Networks vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Arista Networks flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-114625 Arista VeloCloud Orchestrator SQL InjectionExploited since Oct 23, 2026 · CVSS 9.4
• CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input ValidationExploited since Sep 22, 2026 · CVSS 9.5
• CVE-2026-16812 Arista VeloCloud Orchestrator On-Prem OS Command InjectionExploited since Jul 27, 2026 · CVSS 10
• CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing FactorsExploited since Jun 9, 2026 · CVSS 6.9

Latest high and critical flaws

• CVE-2026-114625 Arista VeloCloud Orchestrator SQL InjectionExploited · Critical 9.4 · Oct 22, 2026
• CVE-2026-102169 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the High 7.1 · Oct 6, 2026
• CVE-2026-102168 On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the High 7.1 · Oct 6, 2026
• CVE-2026-102167 On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints.Critical 9 · Oct 6, 2026
• CVE-2026-102165 On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service toHigh 7.7 · Oct 6, 2026
• CVE-2026-102163 On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can High 8.7 · Oct 6, 2026
• CVE-2026-102162 On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway servicCritical 9.4 · Oct 6, 2026
• CVE-2026-102161 An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) cHigh 8.7 · Oct 6, 2026
• CVE-2026-102160 An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup rHigh 8.6 · Oct 6, 2026
• CVE-2026-102159 An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services.Critical 9.3 · Oct 6, 2026
• CVE-2026-102158 Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQHigh 7.1 · Oct 6, 2026
• CVE-2026-102155 An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leadiHigh 7.1 · Oct 6, 2026
• CVE-2026-101158 A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site Critical 9.3 · Oct 6, 2026
• CVE-2026-101157 A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes wCritical 9.3 · Oct 6, 2026
• CVE-2026-101155 An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafteHigh 8.6 · Oct 6, 2026
• CVE-2026-101154 An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafteHigh 8.6 · Oct 6, 2026
• CVE-2026-101153 On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists.High 7.2 · Oct 6, 2026
• CVE-2026-101152 Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causeHigh 7.6 · Oct 6, 2026
• CVE-2026-93952 Arista VeloCloud Orchestrator Improper Input ValidationExploited · Critical 9.5 · Sep 22, 2026
• CVE-2026-73462 On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacenHigh 7.1 · Sep 16, 2026
• CVE-2026-73456 Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI clienCritical 9.2 · Sep 16, 2026
• CVE-2026-86107 The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors.High 8.2 · Sep 16, 2026
• CVE-2026-86106 An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification.High 8.7 · Sep 16, 2026
• CVE-2026-73468 A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traHigh 7.1 · Sep 16, 2026
• CVE-2026-73455 On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to rHigh 8.9 · Sep 16, 2026