Arista Networks - vulnerabilities (CVEs)

154 CVEs in 27 products, 25 in the last 30 days, newest from 2026-10-22.

Products

Eos - 75 CVEs
Cloudvision Portal - 12 CVEs
Arista Edge Threat Management - 9 CVEs
Cloudvision Cue - 9 CVEs
Arista Eos - 7 CVEs
Wi-fi Access Points - 7 CVEs
Arista Edge Threat Management - Arista Next Generation Firewall Ngfw - 5 CVEs
Danz Monitoring Fabric - 5 CVEs
Arista Edge Threat Management - Arista Next Generation Firewall - 3 CVEs
Eos Cloudvision Exchange Cvx - 3 CVEs
Velocloud Edge - 3 CVEs
Velocloud Orchestrator On-prem - 3 CVEs
Arista Terminattr - 2 CVEs
Mos - 2 CVEs
Terminattr - 2 CVEs
Arista Edge Threat Management - Arista Ng Firewall Ngfw - 1 CVEs
Arista Wireless Access Points - 1 CVEs
Cloudvision - 1 CVEs
Cloudvision Appliance - 1 CVEs
Cloudvision Sensor - 1 CVEs
Eos-policy Based Routing Pbr - 1 CVEs
Eos - Bgp Flowspec - 1 CVEs
Eos - Interface Traffic Policy - 1 CVEs
Velocloud - 1 CVEs
Velocloud Gateway - 1 CVEs
Velocloud Orchestrator - 1 CVEs
Velocloud Orchestrator Vco On-prem - 1 CVEs

Newest CVEs of Arista Networks

CVE-2026-114625 - CVSS 9.9 (critical), 2026-10-22: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
CVE-2026-102165 - CVSS 7.7 (high), 2026-10-06: On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service…
CVE-2026-102167 - CVSS 9 (critical), 2026-10-06: On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker…
CVE-2026-102164 - CVSS 3.1 (low), 2026-10-06: On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client…
CVE-2026-102163 - CVSS 8.8 (high), 2026-10-06: On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity…
CVE-2026-102169 - CVSS 7.1 (high), 2026-10-06: On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash…
CVE-2026-102168 - CVSS 7.1 (high), 2026-10-06: On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash…
CVE-2026-102162 - CVSS 9.4 (critical), 2026-10-06: On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway…
CVE-2026-101157 - CVSS 9.3 (critical), 2026-10-06: A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes…
CVE-2026-101156 - CVSS 8.4 (high), 2026-10-06: A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The…
CVE-2026-102156 - CVSS 6.9 (medium), 2026-10-06: Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under…
CVE-2026-102160 - CVSS 8.6 (high), 2026-10-06: An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup…
CVE-2026-102161 - CVSS 8.8 (high), 2026-10-06: An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers)…
CVE-2026-102159 - CVSS 9.8 (critical), 2026-10-06: An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services.…
CVE-2026-102158 - CVSS 7.1 (high), 2026-10-06: Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform…
CVE-2026-102155 - CVSS 8.5 (high), 2026-10-06: An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests,…
CVE-2026-102157 - CVSS 6.8 (medium), 2026-10-06: An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific…
CVE-2026-101155 - CVSS 9.1 (critical), 2026-10-06: An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially…
CVE-2026-101154 - CVSS 8.6 (high), 2026-10-06: An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially…
CVE-2026-101153 - CVSS 8 (high), 2026-10-06: On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient…
CVE-2026-101152 - CVSS 8 (high), 2026-10-06: Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,…
CVE-2026-101151 - CVSS 5.3 (medium), 2026-10-06: Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the…
CVE-2026-101149 - CVSS 5.1 (medium), 2026-10-06: Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
CVE-2026-101150 - CVSS 5.1 (medium), 2026-10-06: Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
CVE-2026-101158 - CVSS 9.3 (critical), 2026-10-06: A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored…
CVE-2026-93952 - CVSS 10 (critical), 2026-09-22: VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact…
CVE-2026-73462 - CVSS 7.1 (high), 2026-09-16: On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a…
CVE-2026-73457 - CVSS 6 (medium), 2026-09-16: Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials…
CVE-2026-73456 - CVSS 10 (critical), 2026-09-16: Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI…
CVE-2026-73442 - CVSS 3 (low), 2026-09-16: On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an…