Login Request a demo
EO
Product
EOS
by Arista Networks · last CVE Sep 16, 2026
On CISA KEVExploited in the wild
62
CVEs
1
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities62In the news2Timeline
Severity mix
Critical 6High 13Medium 36Low 7
Severity
All severities62Critical6High13Medium36Low7
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add EOS to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-73456
10.0
1%
Sep 16
Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
Affected: 4.36.0 through 4.36.1F; 4.35.0 through 4.35.5M; 4.34.2F through 4.34.7M
CVE-2026-73453
10.0
1%
Sep 16
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS
Affected: 4.36.0F through 4.36.1F; 4.35.0F through 4.35.5M; 4.34.0F through 4.34.7M; 4.33.0F before 4.34.0F; 4.32.0F before 4.33.0F; 4.31.0F before 4.32.0F; +2 more
CVE-2026-73437
9.6
0%
Sep 15
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
Affected: 4.36.0 through 4.36.1F; 4.35.0 through 4.35.5M; 4.34.0 through 4.34.7.1M; 4.33.0 through 4.33.9M
CVE-2024-27892
9.6
0%
Jun 4
On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).
Affected: 4.31.0 through 4.31.2F; 4.30.0 through 4.30.5M; 4.29.0 through 4.29.7M; 4.28.0 through 4.28.10M; 4.27.0 through 4.27.8M; 4.26.0 through 4.26.9M; +2 more
CVE-2024-27890
9.6
4%
Jun 4
On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).
Affected: 4.29.0 through 4.29.7M; 4.28.0 through 4.28.10M; 4.27.0 through 4.27.8M; 4.26.0 through 4.26.9M; 4.25.0 through 4.25.10M; 4.24.0 through 4.24.11M
CVE-2026-73447
9.1
1%
Sep 16
Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
Affected: 4.30.2F before 4.31.0F; 4.31.0F before 4.32.0F; 4.32.0F before 4.33.0F; 4.33.0F through 4.33.8M; 4.34.0F through 4.34.7M; 4.35.0F through 4.35.5M; +1 more
Showing 6