Arista Networks

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-7473	Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet destined for a configured decapsulation IP to be silently unwrapped and forwarded into the network. Unauthenticated remote attackers (PR:N, AV:N per CVSS 4.0) can inject traffic into network segments by exploiting this check bypass on switches with VXLAN, decap-groups, or GRE configurations. The CVE description explicitly states this issue has been reported as exploited in the wild; however, a CISA KEV entry was not confirmed in the provided data. The integrity impact is assessed as low on both the vulnerable and subsequent systems per CVSS 4.0 (VI:L/SI:L), but the network trust boundary violation in a core switching context warrants elevated operational priority.	MEDIUM	6.9	0.0%	105	KEV PoC No patch
CVE-2026-17191	We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields. CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:::::::: Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov. Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)	HIGH	8.5	2.8%	45
CVE-2025-5088	Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.	HIGH	8.7	0.0%	44
CVE-2023-5502	On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.	HIGH	8.2	0.0%	41	No patch
CVE-2026-2379	Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.	HIGH	8.2	0.0%	41
CVE-2026-86108	OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.	HIGH	7.5	–	38
CVE-2024-27890	Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.	HIGH	7.2	0.3%	36	No patch
CVE-2024-27892	Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.	HIGH	7.2	0.1%	36	No patch
CVE-2025-5089	Denial of service in Arista EOS switches and CloudVision Exchange (CVX) servers arises from improper input validation in the TCP messaging protocol that governs EOS-CVX cluster communication. Sending malformed messages in either direction - from a CVX server to an EOS switch, or vice versa - triggers a Sysdb agent crash on the EOS device (causing a soft reset) or agent crashes on the CVX server (causing cluster-wide instability). Exploitation requires the attacker to already hold high-privilege access on a device within the cluster, and no public exploit code or CISA KEV listing exists at time of analysis, making this a targeted insider or post-compromise threat rather than an opportunistic one.	HIGH	7.1	0.0%	36
CVE-2025-5090	Denial of service in Arista CloudVision Exchange (CVX) allows an attacker with high-privilege access to a connected switch to crash CVX agents by sending malformed TCP packets, causing instability across the CVX cluster. The flaw stems from improper input validation (CWE-20) of messages received from connected switches, and no public exploit has been identified at time of analysis.	HIGH	7.1	0.0%	36
CVE-2026-73450	Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.	HIGH	7.0	–	35
CVE-2024-27891	On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.	MEDIUM	6.9	0.1%	35
CVE-2026-17192	We need to produce a JSON object with all the specified fields. The input provides CVE-2026-17192, description, CVSS 4.0 vector, CWE, tags, references, CPE, and note about internal discovery. No EPSS, no KEV, no POC mentioned. So exploitation status: no public exploit identified. Patch status: need to check references. The advisory URL is provided. We need to extract patch version info. Since it's a security advisory from Arista, likely they have a fixed version. But the input does not explicitly state the fix version. We should check the advisory URL content? But we only have the URL, not the content. However, the instruction says "Use ALL the data provided". The references contain advisory URL. We can assume that patch is available per vendor advisory, but we don't have an exact version. The CPE indicates the product is "arista_networks:velocloud_orchestrator_on-prem". So product name: "Velocloud Orchestrator On-Prem". But careful: The description says "A VCO feature" - VCO likely stands for Velocloud Orchestrator. So product_name: "Velocloud Orchestrator". The CPE says "velocloud_orchestrator_on-prem". So we'll use "Velocloud Orchestrator". Summary: Need original synthesis, not copying description. The vulnerability is an SSRF via VCO feature that doesn't validate input, allowing authenticated tenant admins to make requests to internal services. Minimum role Enterprise Standard Admin. No known exploitation. Technical context: CWE-918 is Server-Side Request Forgery. Explain SSRF, how the VCO feature works, using CPE to identify affected product. Risk assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N. So low impact on vulnerable system (no CIA), but high impact on subsequent system (confidentiality high, integrity low). That means the SSRF allows accessing internal services (subsequent system) and potentially reading sensitive data. But note that exploit requires authenticated user with Enterprise Standard Admin role. So PR:L is	MEDIUM	6.3	2.3%	34
CVE-2024-6858	In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.	MEDIUM	6.5	0.2%	33	No patch
CVE-2026-73451	Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.	MEDIUM	6.3	–	32	No patch

CVE-2026-7473

Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet destined for a configured decapsulation IP to be silently unwrapped and forwarded into the network. Unauthenticated remote attackers (PR:N, AV:N per CVSS 4.0) can inject traffic into network segments by exploiting this check bypass on switches with VXLAN, decap-groups, or GRE configurations. The CVE description explicitly states this issue has been reported as exploited in the wild; however, a CISA KEV entry was not confirmed in the provided data. The integrity impact is assessed as low on both the vulnerable and subsequent systems per CVSS 4.0 (VI:L/SI:L), but the network trust boundary violation in a core switching context warrants elevated operational priority.

MEDIUM

6.9

0.0%

105

KEV PoC No patch

CVE-2026-17191

We need to generate a comprehensive analysis JSON for CVE-2026-17191 based on provided data. Let's gather all fields. CVE ID: CVE-2026-17191 Description: An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlying system to initiate unintended outbound network connections. CVSS Score: 8.5 CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X CWE: CWE-89 (SQL Injection) EPSS: 2.83% (85th percentile) Patch: Available from vendor Reported by: Arista CPE: cpe:2.3:a:arista_networks:velocloud_orchestrator_on-prem:*:*:*:*:*:*:*:* Tags: Authentication Bypass, SQLi, Velocloud Orchestrator On Prem SSVC: Exploitation: none, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49371 Affected versions: "VeloCloud Orchestrator On-Prem 5.2.0 <5.2.3.14", "6.1.0 <6.1.3.4", "6.4.0 <6.4.2.4" References: [cveorg] advisory link: https://www.arista.com/en/support/advisories-notices/security-advisory/24365-security-advisory-0145; [euvd] advisory link: nvd.nist.gov. Now, product_name: "Velocloud Orchestrator On-Prem" (or "VeloCloud Orchestrator On-Prem"). Could be "Arista VeloCloud Orchestrator" but tags say "Velocloud Orchestrator On Prem". I'll pick "VeloCloud Orchestrator On-Prem" (official name). product_name should be 1-3 words: "VeloCloud Orchestrator On-Prem" is 3 words? Actually "VeloCloud Orchestrator On-Prem" is 4 words. I'll do "VeloCloud Orchestrator On-Prem" or maybe "VeloCloud Orchestrator". But the description says "an API component of the orchestrator". The CPE specifies "velocloud_orchestrator_on-prem". So product_name: "VeloCloud Orchestrator On-Prem". That's 4, but maybe we can shorten to "VeloCloud Orchestrator" (2 words)

HIGH

8.5

2.8%

45

CVE-2025-5088

Privilege escalation in Arista CloudVision Exchange (CVX) allows an authenticated attacker with network reach to the Redis service to obtain full root access across every server in the CVX cluster. The flaw stems from CVX's reliance on Redis for inter-node coordination combined with the fact that Redis traffic - including authentication - is transmitted in plaintext, meaning anyone who can sniff a single session can replay credentials to compromise the entire cluster. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

HIGH

8.7

0.0%

44

CVE-2023-5502

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

HIGH

8.2

0.0%

41

No patch

CVE-2026-2379

Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

HIGH

8.2

0.0%

41

CVE-2026-86108

OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.

HIGH

7.5

–

38

CVE-2024-27890

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

HIGH

7.2

0.3%

36

No patch

CVE-2024-27892

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

HIGH

7.2

0.1%

36

No patch

CVE-2025-5089

Denial of service in Arista EOS switches and CloudVision Exchange (CVX) servers arises from improper input validation in the TCP messaging protocol that governs EOS-CVX cluster communication. Sending malformed messages in either direction - from a CVX server to an EOS switch, or vice versa - triggers a Sysdb agent crash on the EOS device (causing a soft reset) or agent crashes on the CVX server (causing cluster-wide instability). Exploitation requires the attacker to already hold high-privilege access on a device within the cluster, and no public exploit code or CISA KEV listing exists at time of analysis, making this a targeted insider or post-compromise threat rather than an opportunistic one.

HIGH

7.1

0.0%

36

CVE-2025-5090

Denial of service in Arista CloudVision Exchange (CVX) allows an attacker with high-privilege access to a connected switch to crash CVX agents by sending malformed TCP packets, causing instability across the CVX cluster. The flaw stems from improper input validation (CWE-20) of messages received from connected switches, and no public exploit has been identified at time of analysis.

HIGH

7.1

0.0%

36

CVE-2026-73450

Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.

HIGH

7.0

–

35

CVE-2024-27891

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

MEDIUM

6.9

0.1%

35

CVE-2026-17192

We need to produce a JSON object with all the specified fields. The input provides CVE-2026-17192, description, CVSS 4.0 vector, CWE, tags, references, CPE, and note about internal discovery. No EPSS, no KEV, no POC mentioned. So exploitation status: no public exploit identified. Patch status: need to check references. The advisory URL is provided. We need to extract patch version info. Since it's a security advisory from Arista, likely they have a fixed version. But the input does not explicitly state the fix version. We should check the advisory URL content? But we only have the URL, not the content. However, the instruction says "Use ALL the data provided". The references contain advisory URL. We can assume that patch is available per vendor advisory, but we don't have an exact version. The CPE indicates the product is "arista_networks:velocloud_orchestrator_on-prem". So product name: "Velocloud Orchestrator On-Prem". But careful: The description says "A VCO feature" - VCO likely stands for Velocloud Orchestrator. So product_name: "Velocloud Orchestrator". The CPE says "velocloud_orchestrator_on-prem". So we'll use "Velocloud Orchestrator". Summary: Need original synthesis, not copying description. The vulnerability is an SSRF via VCO feature that doesn't validate input, allowing authenticated tenant admins to make requests to internal services. Minimum role Enterprise Standard Admin. No known exploitation. Technical context: CWE-918 is Server-Side Request Forgery. Explain SSRF, how the VCO feature works, using CPE to identify affected product. Risk assessment: CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N. So low impact on vulnerable system (no CIA), but high impact on subsequent system (confidentiality high, integrity low). That means the SSRF allows accessing internal services (subsequent system) and potentially reading sensitive data. But note that exploit requires authenticated user with Enterprise Standard Admin role. So PR:L is

MEDIUM

6.3

2.3%

34

CVE-2024-6858

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

MEDIUM

6.5

0.2%

33

No patch

CVE-2026-73451

Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE.

MEDIUM

6.3

–

32

No patch

Severity Breakdown

Monthly CVE Trend

Affected Products (5)

Top Risky CVEs