arista has 4 CVEs on record between 2020 and 2026. 1 was published in the last 90 days. The median CVSS is 7.7 (high), with 1 rated critical. Most affected products: velocloud_orchestrator (2), access_point (1), eos (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 50% vs 1% corpus
- Median CVSS
- 7.7
- Publish → KEV
- —(2)
- Last 90 days
- 1 prev 1
Weakness classes
Products
- velocloud_orchestrator 2
- access_point 1
- eos 1
Worst active — by depth score
CVE-2026-93952Critical· 10.0VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host80CVE-2026-7473Medium· 5.8On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly d…57CVE-2020-3973High· 8.8The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection49CVE-2020-3702Medium· 6.5u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in…36
arista vulnerabilities
CVEs affecting arista, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-93952Critical· 10.0CISA KEV0dayPoCVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integ…
CVE-2026-7473Medium· 5.8CISA KEVPoCOn affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly d…
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly d…
CVE-2020-3702Medium· 6.5u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in…
u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in…
CVE-2020-3973High· 8.8The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection
The VeloCloud Orchestrator does not apply correct input validation which allows for blind SQL-injection. A malicious actor with tenant access to Velocloud Orchestrator could enter specially crafted SQL queries and obtain data to which th…