7
CVEs
1
Critical
2
High
0
KEV
2
PoC
0
Unpatched C/H
42.9%
Patch Rate
0%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
2
MEDIUM
4
LOW
0
Monthly CVE Trend
Affected Products (4)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-73447 | Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. | CRITICAL | 9.4 | – | 47 |
PoC
|
| CVE-2026-86108 | OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record. | HIGH | 7.5 | – | 38 |
PoC
|
| CVE-2026-73450 | Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.0 | – | 35 |
|
| CVE-2026-73451 | Ingress Security ACLs applied to Switched Virtual Interfaces (SVIs) in shared mode on dual-switchcard Arista EOS platforms can silently stop filtering after the secondary switchcard forwarding agent restarts or a secondary switchcard is inserted, causing packets that should be denied to be permitted (and vice versa). The flaw is rated CVSS 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-1419 incorrect resource initialization) and only affects modular chassis configured with dual switch cards plus shared-mode SVI ingress ACLs. Arista discovered the issue internally and states it is not aware of any malicious exploitation in customer networks; no public exploit code or CISA KEV listing is associated with this CVE. | MEDIUM | 6.3 | – | 32 |
No patch
|
| CVE-2026-73465 | Arista EOS switches can write plaintext private keys into log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Exploitation requires an attacker to already hold authenticated local administrative access to the device shell and to have those special debug trace levels turned on, so the practical exposure is primarily insider or post-compromise rather than remote. Arista discovered the flaw internally (SA-0153), states it is unaware of malicious exploitation in customer networks, and the issue is not listed in CISA KEV and no public exploit code has been identified. | MEDIUM | 6.0 | – | 30 |
No patch
|
| CVE-2026-73466 | Cleartext user passwords can be written into Arista EOS log files when specialized, non-standard debugging trace levels are explicitly enabled on the device. Only operators who already hold authenticated local administrative shell access and who have turned on these unusual trace levels are exposed, and a user must actually authenticate while tracing is active for credentials to be recorded. Arista discovered the flaw internally, states it is not aware of any malicious exploitation, and no public exploit code or CISA KEV entry has been identified; vendor advisory SA-0153 documents the fix | MEDIUM | 6.0 | – | 30 |
No patch
|
| CVE-2026-73467 | Affected versions of Arista EOS can write plaintext TACACS+ shared secrets into a location an operator can read, exposing the secret that protects authentication traffic between the switch and its AAA servers. Exploitation is not remote: it requires a highly privileged local session (CVSS PR:H), a non-default/specific set of circumstances (AC:H), and a user action (UI:R), which is why the score sits at 6.3 despite high confidentiality, integrity, and availability metrics. There is no public exploit code identified and the issue is not listed in CISA KEV, so this is a hardening/credential-hygiene issue rather than an actively attacked one; note that a leaked TACACS+ secret is high-value for lateral movement across network infrastructure. | MEDIUM | 6.0 | – | 30 |
No patch
|