Arista Networks
122 CVEs across 23 Arista Networks products. Browse Arista Networks vulnerabilities, severities, and proof-of-concept exploits.
Arista Networks products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93952 | Critical | 10.0 | 2026-09-22 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-73462 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjace… |
CVE-2026-73457 | Medium | 5.3 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials… |
CVE-2026-73456 | Critical | 10.0 | 2026-09-16 | Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI clie… |
CVE-2026-73443 | Medium | 4.7 | 2026-09-16 | On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on wh… |
CVE-2026-73442 | Low | 3.0 | 2026-09-16 | On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an… |
CVE-2026-86107 | Medium | 5.9 | 2026-09-16 | The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This… |
CVE-2026-86106 | Critical | 9.6 | 2026-09-16 | An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in… |
CVE-2026-77190 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mod… |
CVE-2026-73469 | Medium | 5.8 | 2026-09-16 | When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the int… |
CVE-2026-73468 | Medium | 6.5 | 2026-09-16 | A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast tr… |
CVE-2026-73455 | High | 7.5 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to… |
CVE-2026-73453 | Critical | 10.0 | 2026-09-16 | An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions… |
CVE-2026-73440 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a… |
CVE-2026-73438 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast… |
CVE-2026-73436 | Medium | 6.5 | 2026-09-16 | On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor ma… |
CVE-2026-73435 | High | 8.2 | 2026-09-16 | On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated… |
CVE-2026-19640 | Medium | 4.2 | 2026-09-16 | On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization… |
CVE-2026-73464 | High | 8.8 | 2026-09-16 | On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticat… |
CVE-2026-73463 | Medium | 5.3 | 2026-09-16 | On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz se… |
CVE-2026-73461 | High | 8.0 | 2026-09-16 | On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong priv… |
CVE-2026-73454 | High | 8.1 | 2026-09-16 | On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended m… |
CVE-2026-73445 | Medium | 4.9 | 2026-09-16 | On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which w… |
CVE-2026-73439 | High | 7.5 | 2026-09-16 | On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz… |
CVE-2026-2380 | High | 7.4 | 2026-09-16 | On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be uni… |
CVE-2026-73447 | Critical | 9.1 | 2026-09-16 | A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated use… |
CVE-2026-86108 | High | 8.0 | 2026-09-16 | Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or… |
CVE-2026-73450 | Medium | 6.9 | 2026-09-16 | On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection net… |
CVE-2026-73460 | Medium | 6.1 | 2026-09-16 | On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can c… |
CVE-2026-73459 | High | 7.4 | 2026-09-16 | On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legi… |
CVE-2026-73446 | High | 7.4 | 2026-09-16 | On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Da… |
CVE-2026-73444 | Medium | 4.7 | 2026-09-15 | On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the… |
CVE-2026-73437 | Critical | 9.6 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access coul… |
CVE-2026-19655 | Medium | 6.5 | 2026-09-15 | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or… |
CVE-2026-73458 | High | 8.2 | 2026-09-15 | On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause… |
CVE-2026-73467 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System… |
CVE-2026-73466 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when speciali… |
CVE-2026-73465 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when s… |
CVE-2026-73451 | Medium | 4.8 | 2026-09-15 | On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode… |
CVE-2026-19641 | Medium | 5.3 | 2026-09-15 | On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repea… |
CVE-2026-77191 | Low | 2.6 | 2026-09-14 | An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (millis… |
CVE-2026-75945 | Low | 2.6 | 2026-09-14 | A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. |
CVE-2026-75944 | Low | 2.6 | 2026-09-14 | A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale… |
CVE-2026-75943 | Low | 2.6 | 2026-09-14 | A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to… |
CVE-2026-73449 | Medium | 5.9 | 2026-09-14 | On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privile… |
CVE-2026-17192 | High | 8.5 | 2026-07-27 | A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal service… |
CVE-2026-17191 | Critical | 9.1 | 2026-07-27 | An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, wh… |
CVE-2026-16812 | Critical | 10.0 | 2026-07-27 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact t… |
CVE-2026-25620 | Medium | 6.0 | 2026-06-05 | An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generat… |
CVE-2026-2379 | Medium | 5.9 | 2026-06-05 | On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases… |
CVE-2026-7473 | Medium | 5.8 | 2026-06-05 | On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Rou… |
CVE-2025-5089 | Medium | 6.5 | 2026-06-05 | In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the… |
CVE-2025-8873 | High | 7.5 | 2026-06-04 | On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The co… |
CVE-2024-27892 | Critical | 9.6 | 2026-06-04 | Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpecte… |
CVE-2024-27891 | Medium | 5.3 | 2026-06-04 | On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egress… |
CVE-2024-27890 | Critical | 9.6 | 2026-06-04 | Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpecte… |
CVE-2023-5502 | Medium | 5.9 | 2026-06-04 | On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports… |
CVE-2024-6858 | Medium | 6.5 | 2026-06-04 | In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the f… |
CVE-2025-7048 | Medium | 4.3 | 2026-01-06 | On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuo… |
CVE-2025-8872 | Medium | 6.5 | 2025-12-16 | On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may… |
CVE-2025-8870 | Medium | 4.9 | 2025-11-14 | On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.153 |
CVE-2025-54549 | Medium | 5.9 | 2025-10-29 | Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISO |
CVE-2025-54548 | Medium | 4.3 | 2025-10-29 | On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes) |
CVE-2025-54547 | Medium | 5.3 | 2025-10-29 | On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could per… |
CVE-2025-54546 | High | 7.5 | 2025-10-29 | On affected platforms, restricted users could use SSH port forwarding to access host-internal services |
CVE-2025-54545 | High | 7.8 | 2025-10-29 | On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges. |
CVE-2025-6980 | High | 7.5 | 2025-10-23 | Captive Portal can expose sensitive information |
CVE-2025-6979 | High | 8.8 | 2025-10-23 | Captive Portal can allow authentication bypass |
CVE-2025-6978 | High | 7.2 | 2025-10-23 | Diagnostics command injection vulnerability |
CVE-2025-6188 | High | 7.5 | 2025-08-25 | On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing… |
CVE-2025-3456 | Low | 3.8 | 2025-08-25 | On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowl… |
CVE-2025-2826 | Low | 2.6 | 2025-05-27 | n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or mo… |
CVE-2025-2796 | Medium | 5.3 | 2025-05-27 | On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behav… |
CVE-2024-11185 | Medium | 6.5 | 2025-05-27 | On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with diff… |
CVE-2024-9448 | High | 7.5 | 2025-05-08 | On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rule… |
CVE-2025-0505 | Critical | 10.0 | 2025-05-08 | On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision sys… |
CVE-2024-8100 | High | 8.7 | 2025-05-08 | On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision. |
CVE-2024-12378 | Critical | 9.1 | 2025-05-08 | On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan t… |
CVE-2024-11186 | Critical | 10.0 | 2025-05-08 | On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS dev… |
CVE-2025-0936 | Medium | 6.5 | 2025-05-07 | On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cau… |
CVE-2024-9135 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with BGP Link State configured, BGP peer flap can cause the BGP agent to leak memory. This may result in BGP routing p… |
CVE-2024-8000 | Medium | 5.3 | 2025-03-04 | On affected platforms running Arista EOS with 802.1X configured, certain conditions may occur where a dynamic ACL is received from the AAA server resulting in… |
CVE-2025-1260 | Critical | 9.1 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unex… |
CVE-2025-1259 | High | 7.7 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in user… |
CVE-2024-9188 | High | 8.8 | 2025-01-10 | Specially constructed queries cause cross platform scripting leaking administrator tokens |
CVE-2024-9134 | High | 8.3 | 2025-01-10 | Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection… |
CVE-2024-9133 | Medium | 6.6 | 2025-01-10 | A user with administrator privileges is able to retrieve authentication tokens |
CVE-2024-9132 | High | 8.1 | 2025-01-10 | The administrator is able to configure an insecure captive portal script |
CVE-2024-9131 | High | 7.2 | 2025-01-10 | A user with administrator privileges can perform command injection |
CVE-2024-7142 | Medium | 4.6 | 2025-01-10 | On Arista CloudVision Appliance (CVA) affected releases running on appliances that support hardware disk encryption (DCA-350E-CV only), the disk encryption mig… |
CVE-2024-47520 | High | 7.6 | 2025-01-10 | A user with advanced report application access rights can perform actions for which they are not authorized |
CVE-2024-47519 | High | 8.3 | 2025-01-10 | Backup uploads to ETM subject to man-in-the-middle interception |
CVE-2024-47518 | Medium | 6.4 | 2025-01-10 | Specially constructed queries targeting ETM could discover active remote access sessions |
CVE-2024-47517 | Medium | 6.8 | 2025-01-10 | Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access |
CVE-2024-7095 | Medium | 4.3 | 2025-01-10 | On affected platforms running Arista EOS with SNMP configured, if “snmp-server transmit max-size” is configured, under some circumstances a specially crafted p… |
CVE-2024-5872 | Medium | 6.5 | 2025-01-10 | On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane be… |
CVE-2024-6437 | Medium | 5.8 | 2025-01-10 | On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Fl… |
CVE-2024-4578 | High | 8.4 | 2024-06-27 | This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “conf… |
CVE-2024-27889 | High | 8.8 | 2024-03-04 | Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advance… |
CVE-2023-6068 | Low | 3.1 | 2024-03-04 | On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the c… |