7
CVEs
1
Critical
4
High
1
KEV
1
PoC
4
Unpatched C/H
14.3%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
4
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (30)
Eos
25
Ng Firewall
20
Debian Linux
15
Cloudvision Portal
8
C 65 Firmware
7
C 75 Firmware
7
Ubuntu Linux
7
Enterprise Linux Server
7
W 68 Firmware
7
O 90 Firmware
7
Enterprise Linux Server Aus
6
Linux Enterprise Server
6
Enterprise Linux Workstation
6
Metamako Operating System
6
Enterprise Linux Server Tus
5
C 230 Firmware
5
Virtualization
5
Fedora
5
C 130 Firmware
5
C 110 Firmware
5
C 260 Firmware
5
C 250 Firmware
5
C 235 Firmware
5
C 120 Firmware
5
O 105 Firmware
5
Enterprise Linux Eus
5
W 118 Firmware
5
Enterprise Linux Desktop
5
C 100 Firmware
5
C 200 Firmware
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16812 | Command injection vulnerability in VeloCloud Orchestrator (VCO) on-premises allows unauthenticated remote attackers to access internal functionality and fully compromise the host system, impacting data managed by the orchestrator. This issue is known to be actively exploited. Hosted and Dedicated VCO versions have been pre-emptively patched. | CRITICAL | 10.0 | 1.0% | 121 |
KEV
PoC
|
| CVE-2026-25620 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows authenticated high-privileged remote attackers to inject OS commands through the Captive Portal application framework via encrypted password handling. The flaw is unique to release 17.4.0 with earlier versions unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score of 7.0 reflects high attacker privilege requirement balanced against high confidentiality impact on the firewall appliance. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-25622 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows administrators authenticated to the management UI to execute arbitrary shell commands on the underlying platform. The CVSS 4.0 score of 7.0 reflects high privilege requirements (PR:H) offset by network reach and high confidentiality impact, with no public exploit identified at time of analysis. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-25623 | Authenticated command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) allows administrators with existing access to the browser management pipeline to break out and execute arbitrary terminal/shell script code on the underlying appliance OS. The flaw stems from insufficient input validation (CWE-78) within management-plane functionality and carries a CVSS 4.0 score of 7.0 with no public exploit identified at time of analysis. Because exploitation requires high-privileged authentication, the issue is a privilege-boundary breach rather than an unauthenticated remote takeover. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-25621 | Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged authenticated attackers to abuse insecure input validation in the Reports application to execute OS commands on the appliance. The flaw uniquely affects 17.4.0, with earlier releases unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.0 with confidentiality high and integrity/availability low, reflecting a scope-changing impact constrained by the high privileges required. | HIGH | 7.0 | 0.0% | 35 |
No patch
|
| CVE-2026-25624 | Cross-site scripting in the Arista Edge Threat Management Next Generation Firewall web UI dashboard allows a high-privileged attacker to inject unvalidated input that is reflected back into administrative profiles, enabling script execution in the context of other administrative sessions. The vulnerability carries a CVSS 4.0 score of 5.8 (Medium), with confidentiality impact rated High on the vulnerable system - consistent with session token or credential harvesting from targeted admin accounts. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis. | MEDIUM | 5.8 | 0.0% | 29 |
No patch
|
| CVE-2026-75945 | Arista EOS 4.36.0 through 4.36.1F contains a race condition in IEEE 802.1X port-based Network Access Control that can leave a supplicant in an authorized state after an administrator explicitly issues the 'clear dot1x host all' deauthorization command. The flaw (CWE-459: Incomplete Cleanup) means that a device intended to be removed from the network may retain valid access, undermining the administrative action entirely. No public exploit code exists and SSVC exploitation status is confirmed as none; however, the integrity gap created - a device that should be denied access remaining authorized - is the primary concern for network access control posture. | LOW | 2.1 | 0.1% | 10 |
No patch
|