[ Vendor · 28 CVEs ]
Arista Networks
CVEs affecting Arista Networks published in the last 30 days, plus any Arista Networks CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114625 | 22 Oct 2026 | CVSS 9.9 | Arista Networks VeloCloud OrchestratorVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality… | |
| CVE-2026-102168 | 6 Oct 2026 | CVSS 6.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can… | |
| CVE-2026-102169 | 6 Oct 2026 | CVSS 6.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can… | |
| CVE-2026-102160 | 6 Oct 2026 | CVSS 7.2 | Arista Networks CloudVision CUEAn operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a… | |
| CVE-2026-102161 | 6 Oct 2026 | CVSS 8.8 | Arista Networks CloudVision CUEAn unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client… | |
| CVE-2026-102162 | 6 Oct 2026 | CVSS 8.8 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless… | |
| CVE-2026-102163 | 6 Oct 2026 | CVSS 8.8 | Arista Networks Wi-Fi Access PointsOn affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF)… | |
| CVE-2026-102164 | 6 Oct 2026 | CVSS 3.1 | Arista Networks Wi-Fi Access PointsOn affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless… | |
| CVE-2026-102165 | 6 Oct 2026 | CVSS 7.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the… | |
| CVE-2026-102167 | 6 Oct 2026 | CVSS 7.5 | Arista Networks Wi-Fi Access PointsOn affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated… | |
| CVE-2026-101158 | 6 Oct 2026 | CVSS 8.4 | Arista Networks CloudVision PortalA missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored… | |
| CVE-2026-102155 | 6 Oct 2026 | CVSS 8.5 | Arista Networks CloudVision CUEAn XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious… | |
| CVE-2026-102156 | 6 Oct 2026 | CVSS 6.8 | Arista Networks CloudVision CUEImproper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under… | |
| CVE-2026-102157 | 6 Oct 2026 | CVSS 5.9 | Arista Networks CloudVision CUEAn insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under… | |
| CVE-2026-102158 | 6 Oct 2026 | CVSS 6.5 | Arista Networks CloudVision CUEImproper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to… | |
| CVE-2026-102159 | 6 Oct 2026 | CVSS 9.8 | Arista Networks CloudVision CUEAn access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal… | |
| CVE-2026-101151 | 6 Oct 2026 | CVSS 4.3 | Arista Networks CloudVision PortalInsufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user… | |
| CVE-2026-101152 | 6 Oct 2026 | CVSS 8.0 | Arista Networks CloudVision PortalInsufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a… | |
| CVE-2026-101153 | 6 Oct 2026 | CVSS 8.0 | Arista Networks CloudVision PortalOn affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with… | |
| CVE-2026-101154 | 6 Oct 2026 | CVSS 7.2 | Arista Networks CloudVision PortalAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through… | |
| CVE-2026-101155 | 6 Oct 2026 | CVSS 9.1 | Arista Networks CloudVision PortalAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through… | |
| CVE-2026-101156 | 6 Oct 2026 | CVSS 8.4 | Arista Networks CloudVision CUEA stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a… | |
| CVE-2026-101157 | 6 Oct 2026 | CVSS 8.7 | Arista Networks CloudVision CUEA stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that… | |
| CVE-2026-101149 | 6 Oct 2026 | CVSS 4.1 | Arista Networks CloudVision PortalInsufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary… | |
| CVE-2026-101150 | 6 Oct 2026 | CVSS 4.1 | Arista Networks CloudVision PortalInsufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary… | |
| CVE-2026-93952 | 22 Sep 2026 | CVSS 10.0 | Arista VeloCloud Orchestrator Improper Input ValidationVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality… | Exploited |
| CVE-2026-16812 | 27 Jul 2026 | CVSS 10.0 | Arista VeloCloud Orchestrator On-Prem OS Command InjectionVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality… | Exploited |
| CVE-2026-7473 | 5 Jun 2026 | CVSS 5.8 | Arista Extensible Operating System Incomplete Comparison with Missing FactorsOn affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE… | Exploited |