Arista Networks vulnerabilities
We track 81 vulnerabilities in Arista Networks products across 19 products. 80 are rated high or critical, and 6 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Arista Networks vulnerabilities
- 8.1 High severity
EOS: Improper Neutralization of Special Elements used in a Command
On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevat
- 7.5 High severity
EOS: Placement of User into Incorrect Group
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if
- 7.4 High severity
EOS: Plaintext Storage of a Password
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting ser
- 9.1 Critical severity
EOS: Improper Neutralization of Special Elements used in an OS Command
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to es
- 8.0 High severity
VeloCloud Edge: Improper Neutralization of Special Elements used in an OS Command
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may al
- 7.4 High severity
EOS: Improper Validation of Integrity Check Value
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic l
- 7.4 High severity
EOS: Incorrect Behavior Order
On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in
- 9.6 Critical severity
EOS: Insufficient Verification of Data Authenticity
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and
- 8.2 High severity
EOS: Incorrect Implementation of Authentication Algorithm
On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing
- 8.5 High severity
VeloCloud Orchestrator On-Prem: Server-Side Request Forgery
A VCO feature does not sufficiently validate caller-supplied input, allowing requests to be made on behalf of authenticated tenant accounts to internal services that are not otherwise accessible. This vulnerability requires a minimum role of Enterprise Standar
- 9.1 Critical severity
VeloCloud Orchestrator On-Prem: Improper Neutralization of Special Elements used in an SQL Command
An input validation vulnerability exists in an API component of the orchestrator. An authenticated user can exploit this flaw to manipulate backend queries, which may result in unauthorized access to data beyond their intended privileges and cause the underlyi
- 10.0 Critical severity
Arista VeloCloud Orchestrator On-Prem OS Command Injection Exploited
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability
- 5.8 Medium severity
Arista Extensible Operating System Incomplete Comparison with Missing Factors Exploited
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward
- 8.3 High severity
EOS / CloudVision eXchange (CVX): Improper Privilege Management
An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Re
- 7.5 High severity
EOS: Improper Validation of Syntactic Correctness of Input
On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After rese
- 9.6 Critical severity
EOS: Missing Authentication for Critical Functionality
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
- 9.6 Critical severity
EOS: Missing Authentication for Critical Functionality
Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.
- 7.5 High severity
EOS: Authentication Bypass by Spoofing
On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not p
- 7.5 High severity
EOS: Improper Validation of Specified Quantity in Input
On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped a
- 10.0 Critical severity
CloudVision Portal: Improper Privilege Management
On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision system, with more permissions than necessary, which can be used to query or manipulate system state for
- 8.7 High severity
CloudVision: Improper Privilege Management
On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin privileges on CloudVision.
- 9.1 Critical severity
CloudVision Portal: Cleartext Transmission of Sensitive Information
On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.
- 10.0 Critical severity
CloudVision Portal: Improper Authentication
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise.
- 9.6 Critical severity
NG Firewall: Improper Neutralization of Input During Web Page Generation
Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Minimal user interaction is required to exploit this v
- 9.1 Critical severity
EOS: Improper Access Control
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.
- 7.7 High severity
EOS: Improper Access Control
On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available
- 8.3 High severity
Arista Edge Threat Management: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in the reporting application. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with elevated privileges.
- 7.8 High severity
NG Firewall: Incorrect Authorization
Arista NG Firewall uvm_login Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Arista NG Firewall. An attacker must first obtain the ability to execute low-
- 7.3 High severity
NG Firewall: Improper Limitation of a Pathname to a Restricted Directory
Arista NG Firewall custom_handler Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this vuln
- 8.8 High severity
NG Firewall: Improper Neutralization of Special Elements used in an OS Command
Arista NG Firewall ExecManagerImpl Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this vulnerabi
- 8.1 High severity
Red Hat Enterprise Linux 9: Concurrent Execution using Shared Resource with Improper Synchronization
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate
- 8.4 High severity
Arista Wireless Access Points: Improper Neutralization of Special Elements used in a Command
This Advisory describes an issue that impacts Arista Wireless Access Points. Any entity with the ability to authenticate via SSH to an affected AP as the “config” user is able to cause a privilege escalation via spawning a bash shell. The SSH CLI session does
- 8.8 High severity
Arista Edge Threat Management - Arista NG…: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands o
- 7.5 High severity
EOS: Out-of-bounds Read
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.
- 8.1 High severity
CloudVision: Incorrect Authorization
On affected versions of the CloudVision Portal improper access controls on the connection from devices to CloudVision could enable a malicious actor with network access to CloudVision to get broader access to telemetry and configuration data within the system
- 7.8 High severity
Arista EOS: Improper Privilege Management
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privi
- 7.5 High severity
EOS: Uncontrolled Resource Consumption
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are
- 7.5 High severity
EOS: Missing Release of Memory after Effective Lifetime
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically res
- 7.5 High severity
EOS: Out-of-bounds Read
On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are
- 9.8 Critical severity
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as