Arista Networks vulnerabilities | LiveThreat CVE Feed

CVE	Product	CVSS	EPSS	Published	Summary
CVE-2026-114625 In wildKEVNew	VO VeloCloud Orchestrator Arista Networks	9.9	1%	Oct 22	VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host
CVE-2026-102165	WA Wi-Fi Access Points Arista Networks	7.5	0%	Oct 6	On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote cod
CVE-2026-102167	WA Wi-Fi Access Points Arista Networks	7.5	0%	Oct 6	On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints
CVE-2026-102164	WA Wi-Fi Access Points Arista Networks	3.1	0%	Oct 6	On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a cr
CVE-2026-102163	WA Wi-Fi Access Points Arista Networks	8.8	0%	Oct 6	On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor
CVE-2026-102169	WA Wi-Fi Access Points Arista Networks	6.5	0%	Oct 6	On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP reque
CVE-2026-102168	WA Wi-Fi Access Points Arista Networks	6.5	0%	Oct 6	On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP reque
CVE-2026-102162	WA Wi-Fi Access Points Arista Networks	8.8	0%	Oct 6	On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network
CVE-2026-101157	CC CloudVision CUE Arista Networks	8.7	0%	Oct 6	A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected
CVE-2026-101156	CC CloudVision CUE Arista Networks	8.4	0%	Oct 6	A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration
CVE-2026-102156	CC CloudVision CUE Arista Networks	6.8	0%	Oct 6	Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against
CVE-2026-102161	CC CloudVision CUE Arista Networks	8.8	0%	Oct 6	An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gai
CVE-2026-102160	CC CloudVision CUE Arista Networks	7.2	1%	Oct 6	An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands wi
CVE-2026-102159	CC CloudVision CUE Arista Networks	9.8	0%	Oct 6	An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services
CVE-2026-102158	CC CloudVision CUE Arista Networks	6.5	0%	Oct 6	Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impactin
CVE-2026-102157	CC CloudVision CUE Arista Networks	5.9	0%	Oct 6	An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's
CVE-2026-102155	CC CloudVision CUE Arista Networks	8.5	0%	Oct 6	An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure an
CVE-2026-101155	CP CloudVision Portal Arista Networks	9.1	1%	Oct 6	An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads t
CVE-2026-101154	CP CloudVision Portal Arista Networks	7.2	1%	Oct 6	An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads t
CVE-2026-101153	CP CloudVision Portal Arista Networks	8.0	0%	Oct 6	On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists
CVE-2026-101152	CP CloudVision Portal Arista Networks	8.0	0%	Oct 6	Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver
CVE-2026-101151	CP CloudVision Portal Arista Networks	4.3	0%	Oct 6	Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site
CVE-2026-101150	CP CloudVision Portal Arista Networks	4.1	0%	Oct 6	Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
CVE-2026-101149	CP CloudVision Portal Arista Networks	4.1	0%	Oct 6	Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
CVE-2026-101158	CP CloudVision Portal Arista Networks	8.4	0%	Oct 6	A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS)
CVE-2026-93952 In wildKEV	VO VeloCloud Orchestrator (VCO) On-Prem Arista Networks	10.0	1%	Sep 22	VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host
CVE-2026-73462	EO EOS Arista Networks	6.5	0%	Sep 16	On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I
CVE-2026-73457	EO EOS Arista Networks	5.3	0%	Sep 16	Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.
CVE-2026-73456	EO EOS Arista Networks	10.0	1%	Sep 16	Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
CVE-2026-73442	EO EOS Arista Networks	3.0	0%	Sep 16	On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for
CVE-2026-73443	EO EOS Arista Networks	4.7	0%	Sep 16	On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
CVE-2026-86107	VG VeloCloud Gateway Arista Networks	5.9	0%	Sep 16	The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors
CVE-2026-86106	VE VeloCloud Edge Arista Networks	9.6	0%	Sep 16	An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification
CVE-2026-77190	EO EOS Arista Networks	6.5	0%	Sep 16	On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed
CVE-2026-73468	EO EOS Arista Networks	6.5	0%	Sep 16	A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
CVE-2026-73440	EO EOS Arista Networks	4.2	0%	Sep 16	On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value with
CVE-2026-73469	EO EOS Arista Networks	5.8	0%	Sep 16	When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop
CVE-2026-73453	EO EOS Arista Networks	10.0	1%	Sep 16	An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS
CVE-2026-73455	EO EOS Arista Networks	7.5	0%	Sep 16	On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
CVE-2026-73438	EO EOS Arista Networks	5.3	0%	Sep 16	On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set o
CVE-2026-73436	EO EOS Arista Networks	6.5	0%	Sep 16	On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
CVE-2026-73435	EO EOS Arista Networks	8.2	0%	Sep 16	On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment,
CVE-2026-19640	EO EOS Arista Networks	4.2	0%	Sep 16	On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access bey
CVE-2026-73463	EO EOS Arista Networks	5.3	0%	Sep 16	On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail
CVE-2026-73445	EO EOS Arista Networks	4.9	0%	Sep 16	On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to
CVE-2026-2380	EO EOS Arista Networks	7.4	0%	Sep 16	On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged
CVE-2026-73464	EO EOS Arista Networks	8.8	1%	Sep 16	On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management In
CVE-2026-73454	EO EOS Arista Networks	8.1	0%	Sep 16	On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's prop
CVE-2026-73439	EO EOS Arista Networks	7.5	0%	Sep 16	On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gN
CVE-2026-73461	EO EOS Arista Networks	8.0	0%	Sep 16	On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorizatio
CVE-2026-73447	EO EOS Arista Networks	9.1	1%	Sep 16	Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
CVE-2026-86109	VE VeloCloud Edge Arista Networks	6.6	0%	Sep 16	The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verific
CVE-2026-86108	VE VeloCloud Edge Arista Networks	8.0	1%	Sep 16	Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as
CVE-2026-73450	EO EOS Arista Networks	6.9	0%	Sep 16	On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted p
CVE-2026-73460	EO EOS Arista Networks	6.1	0%	Sep 15	On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure
CVE-2026-73459	EO EOS Arista Networks	7.4	0%	Sep 15	On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from
CVE-2026-73446	EO EOS Arista Networks	7.4	0%	Sep 15	On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to t
CVE-2026-73444	EO EOS Arista Networks	4.7	0%	Sep 15	On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the
CVE-2026-73437	EO EOS Arista Networks	9.6	0%	Sep 15	On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
CVE-2026-19655	EO EOS Arista Networks	6.5	0%	Sep 15	On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent