arista vulnerabilities

Products

• eos 46
• NG Firewall 20
• cloudvision portal 10
• c-65 firmware 8
• c-75 firmware 8
• o-90 firmware 8
• w-68 firmware 8
• c-200 firmware 7
• c-230 firmware 7
• c-235 firmware 7
• c-250 firmware 7
• c-260 firmware 7
• c-100 firmware 6
• c-110 firmware 6
• c-120 firmware 6
• c-130 firmware 6
• metamako operating system 6
• o-105 firmware 6
• w-118 firmware 6
• velocloud orchestrator 5
• cloudeos 4
• terminattr 4
• mos 2
• access point 1
• ceos-lab 1
• cloudvision agni 1
• cloudvision exchange 1
• dcs-7050q eos software 1
• dcs-7050s eos software 1
• dcs-7050t eos software 1

Latest arista CVEs

Newest publication first · page 1 of 5

1. CVE-2026-114625 Security Advisory 0199

   Published 2026-10-22

   Critical·CVSS 9.4 EPSS 1.0% CISA KEV added 2026-10-23 Exploited in the wild

   VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator...

2. CVE-2026-93952 Security Advisory 0183

   Published 2026-09-22

   Critical·CVSS 9.5 EPSS 1.4% CISA KEV added 2026-09-22 Exploited in the wild

   VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator...

3. CVE-2026-16812 VeloCloud Orchestrator OS Command Injection

   Published 2026-07-27

   Critical·CVSS 10.0 EPSS 1.8% CISA KEV added 2026-07-27 Exploited in the wild

   VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator...

4. CVE-2026-25624 Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting

   Published 2026-06-05

   Medium·CVSS 5.8 EPSS 0.15%

   An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vec...

5. CVE-2026-25623 Arista Edge Threat Management NGFW UI Arbitrary Command Execution

   Published 2026-06-05

   High·CVSS 7.0 EPSS 5.6%

   An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing ex...

6. CVE-2026-25622 Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

   Published 2026-06-05

   High·CVSS 7.0 EPSS 9.3%

   A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute ar...

7. CVE-2026-25621 Arista Edge Threat Management NGFW Reports Application Insecure Input Validation

   Published 2026-06-05

   High·CVSS 7.0 EPSS 0.22%

   A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

8. CVE-2026-25620 Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection

   Published 2026-06-05

   High·CVSS 7.0 EPSS 9.3%

   An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

9. CVE-2026-7473 Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

   Published 2026-06-05

   Medium·CVSS 6.9 EPSS 1.1% CISA KEV added 2026-06-09 Exploited in the wild

   On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tun...

10. CVE-2026-31431 crypto: algif_aead - Revert to operating out-of-place

    Published 2026-04-22

    High·CVSS 7.8 EPSS 98.1% CISA KEV added 2026-05-01 Exploited in the wild Framework module

    In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the sourc...

11. CVE-2025-2767 Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability

    Published 2025-04-23

    Critical·CVSS 9.6 EPSS 0.65%

    Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this vulnerability. The sp...

12. CVE-2024-9188 Specially constructed queries cause cross platform scripting leaking administrator tokens

    Published 2025-01-10

    High·CVSS 8.8 EPSS 0.50%

    Specially constructed queries cause cross platform scripting leaking administrator tokens

13. CVE-2024-47520 A user with advanced report application access rights can perform actions for which they are not authorized

    Published 2025-01-10

    High·CVSS 7.6 EPSS 0.43%

    A user with advanced report application access rights can perform actions for which they are not authorized

14. CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception

    Published 2025-01-10

    High·CVSS 7.1 EPSS 0.35%

    Backup uploads to ETM subject to man-in-the-middle interception

15. CVE-2024-47518 Specially constructed queries targeting ETM could discover active remote access sessions

    Published 2025-01-10

    High·CVSS 7.6 EPSS 0.44%

    Specially constructed queries targeting ETM could discover active remote access sessions

16. CVE-2024-47517 Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

    Published 2025-01-10

    Medium·CVSS 6.8 EPSS 0.41%

    Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access

17. CVE-2024-9134 Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the...

    Published 2025-01-10

    High·CVSS 8.3 EPSS 0.64%

    Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.

18. CVE-2024-9133 A user with administrator privileges is able to retrieve authentication tokens

    Published 2025-01-10

    Medium·CVSS 5.6 EPSS 0.16%

    A user with administrator privileges is able to retrieve authentication tokens

19. CVE-2024-9132 The administrator is able to configure an insecure captive portal script

    Published 2025-01-10

    Critical·CVSS 9.8 EPSS 0.71%

    The administrator is able to configure an insecure captive portal script

20. CVE-2024-9131 A user with administrator privileges can perform command injection

    Published 2025-01-10

    High·CVSS 7.2 EPSS 1.4%

    A user with administrator privileges can perform command injection

21. CVE-2024-12831 Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability

    Published 2024-12-20

    High·CVSS 7.8 EPSS 0.16%

    Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-privileged code on t...

22. CVE-2024-12832 Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability

    Published 2024-12-20

    Medium·CVSS 6.3 EPSS 0.50%

    Arista NG Firewall ReportEntry SQL Injection Arbitrary File Read and Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files and disclose sensitive information on affected installations of Arista NG Firewall. Authentication is required to exploit...

23. CVE-2024-12830 Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability

    Published 2024-12-20

    High·CVSS 7.3 EPSS 1.0%

    Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vulnerability. The speci...

24. CVE-2024-12829 Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability

    Published 2024-12-20

    High·CVSS 8.8 EPSS 1.3%

    Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerability. The specific f...

25. CVE-2024-6387 Openssh: regresshion - race condition in ssh allows rce/dos

    Published 2024-07-01

    High·CVSS 8.1 EPSS 99.5%

    A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time pe...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.