14
CVEs
2
Critical
6
High
1
KEV
1
PoC
4
Unpatched C/H
50.0%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
2
HIGH
6
MEDIUM
3
LOW
3
Monthly CVE Trend
Affected Products (30)
Eos
32
Ng Firewall
20
Debian Linux
15
Cloudvision Portal
8
C 65 Firmware
7
C 75 Firmware
7
Ubuntu Linux
7
Enterprise Linux Server
7
W 68 Firmware
7
O 90 Firmware
7
Enterprise Linux Server Aus
6
Linux Enterprise Server
6
Enterprise Linux Workstation
6
Metamako Operating System
6
Enterprise Linux Server Tus
5
C 230 Firmware
5
Virtualization
5
Fedora
5
C 130 Firmware
5
C 110 Firmware
5
C 260 Firmware
5
C 250 Firmware
5
C 235 Firmware
5
C 120 Firmware
5
O 105 Firmware
5
Enterprise Linux Eus
5
W 118 Firmware
5
Enterprise Linux Desktop
5
C 100 Firmware
5
C 200 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16812 | Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched. | CRITICAL | 10.0 | 1.0% | 121 |
KEV
PoC
|
| CVE-2026-73453 | Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis. | CRITICAL | 9.5 | – | 48 |
|
| CVE-2026-73464 | Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166. | HIGH | 8.7 | – | 44 |
|
| CVE-2026-25620 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated high-privileged remote attackers to inject OS commands through the Captive Portal application framework via encrypted password handling. The flaw is unique to release 17.4.0 with earlier versions unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score of 7.0 reflects high attacker privilege requirement balanced against high confidentiality impact on the firewall appliance. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-25622 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows administrators authenticated to the management UI to execute arbitrary shell commands on the underlying platform. The CVSS 4.0 score of 7.0 reflects high privilege requirements (PR:H) offset by network reach and high confidentiality impact, with no public exploit identified at time of analysis. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-25623 | Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators with existing access to the browser management pipeline to break out and execute arbitrary terminal/shell script code on the underlying appliance OS. The flaw stems from insufficient input validation (CWE-78) within management-plane functionality and carries a CVSS 4.0 score of 7.0 with no public exploit identified at time of analysis. Because exploitation requires high-privileged authentication, the issue is a privilege-boundary breach rather than an unauthenticated remote takeover. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-25621 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged authenticated attackers to abuse insecure input validation in the Reports application to execute OS commands on the appliance. The flaw uniquely affects 17.4.0, with earlier releases unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.0 with confidentiality high and integrity/availability low, reflecting a scope-changing impact constrained by the high privileges required. | HIGH | 7.0 | 0.0% | 35 |
No patch
|
| CVE-2026-73438 | A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks. | HIGH | 7.0 | – | 35 |
|
| CVE-2026-73469 | Loose-mode Unicast Reverse Path Forwarding (uRPF) on certain Arista EOS platforms can fail to drop traffic that the configured source-address verification should have rejected, so packets that ought to be filtered are still processed and forwarded by the switch or router. Only devices running Arista EOS on one of the specific (unnamed) affected platforms and explicitly configured with loose uRPF are exposed - default deployments that do not enable uRPF are not affected, and there is no confidentiality or availability impact, only a loss of filter integrity. No public exploit code and no confirmed active exploitation have been identified at time of analysis; the vendor CVSS score of 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) is well calibrated to this narrow, configuration-dependent filtering failure. | MEDIUM | 6.9 | – | 34 |
No patch
|
| CVE-2026-73436 | A crafted OSPFv2 packet delivered by an adjacent OSPF neighbor can force an unexpected restart of the OSPF process on Arista EOS devices that run both OSPFv2 and OSPFv2 segment routing, producing an availability-only denial of service (CVSS 6.5, AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Only deployments with segment routing enabled under OSPF are exposed, since this is not a default OSPF setting, and the attacker must already be positioned on the same routing segment or link (typically a compromised or rogue device inside the OSPF domain) rather than an arbitrary internet host. No authentication or user interaction is required once adjacency is achievable, repeated packets can sustain the outage, and no public exploit code or confirmed active exploitation has been identified at time of analysis. | MEDIUM | 6.0 | – | 30 |
|
| CVE-2026-25624 | Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privileged attacker to inject unvalidated input that is reflected back into administrative profiles, enabling script execution in the context of other administrative sessions. The vulnerability carries a CVSS 4.0 score of 5.8 (Medium), with confidentiality impact rated High on the vulnerable system - consistent with session token or credential harvesting from targeted admin accounts. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 5.8 | 0.0% | 29 |
No patch
|
| CVE-2026-19640 | Incorrect authorization results in Arista EOS gNMI (gRPC Network Management Interface) can allow an already-authenticated management user to reach resources and operations slightly beyond the permissions assigned to their role. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, score 4.2), exploitation requires the gNMI interface to be enabled and reachable plus a valid account with at least some gNMI access, and success depends on specific role/permission configurations - a high-complexity, low-impact condition rather than a remote unauthenticated bypass. There is no public exploit identified at time of analysis, no CISA KEV listing, and Arista states the issue was found internally with no known malicious use in customer networks. | LOW | 2.3 | – | 12 |
|
| CVE-2026-73440 | Arista EOS devices configured with SNMPv3 users store the one-way hashed, localized SNMPv3 authentication key inside the running configuration and, notably, inside sanitized configuration exports, so any authenticated user who can read either artifact obtains reusable credential material for that device's SNMP engine. With that material an attacker can issue unauthorized SNMP read operations against MIB tables or inject fraudulent trap notifications into the Network Management System, though there is no configuration-write or availability impact. The vendor discovered the flaw internally, states it is unaware of malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 4.2 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N), with exploitation gated on SNMPv3 being in use and on the attacker already holding authenticated device access or a leaked sanitized configuration. | LOW | 2.3 | – | 12 |
|
| CVE-2026-75945 | Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture. | LOW | 2.1 | 0.1% | 10 |
No patch
|