High severity · published Oct 6, 2026
CVE-2026-102167
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WA
Wi-Fi Access Points · Arista Networks
22.0.0 through 22.0.1F-32; 21.3.0 through 21.3.0M-13; 1.0.0 before 21.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102167
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102167
vendor-advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197
More from Wi-Fi Access Points
8.8
CVE-2026-102163
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor
8.8
CVE-2026-102162
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network
7.5
CVE-2026-102165
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote cod
6.5
CVE-2026-102169
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP reque
6.5
CVE-2026-102168
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP reque