Vulnerabilities by vendor · updated on every deploy
Arista vulnerabilities: exploited CVEs and our analysis
Arista has 3 vulnerabilities in CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months. Below: the 3 analyses Zero Hunt Research published on Arista products, then the catalog entries newest first with the federal due date.
CISA catalog version 2026.10.21, released 2026-10-21 14:04 UTC.
3
CVEs in CISA KEV
3
Added in the last 12 months
0
Known ransomware use
3
Zero Hunt analyses
Products with the most KEV entries: VeloCloud Orchestrator (2) · Extensible Operating System (1)
Our analysis of Arista vulnerabilities
2026-09-27
Arista VeloCloud Orchestrator CVE-2026-93952: SD-WAN Auth Bypass Exploited in the WildCVE-2026-93952 is a CVSS 10.0 auth-bypass zero-day in Arista VeloCloud Orchestrator, exploited in the wild. Fixed versions, IOCs and a remediation runbook.
2026-07-28
VeloCloud CVE-2026-16812: One SD-WAN Orchestrator, Every BranchCVE-2026-16812 is a CVSS 10.0 unauthenticated command injection in Arista VeloCloud Orchestrator, exploited as a zero-day. CISA gave it a three-day clock. Here is why, and what to do.
2026-06-19
Arista EOS CVE-2026-7473: An Exploited Bug With No Patch ComingCVE-2026-7473 is on CISA KEV, actively exploited, and Arista plans no patch. Why your scanner and patch dashboard both miss this Arista EOS segmentation bypass.
All 3 KEV entries
| Added | CVE | Product and vulnerability | Federal due date | Flags | Our analysis |
|---|---|---|---|---|---|
| 2026-09-22 | CVE-2026-93952 | VeloCloud Orchestrator Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploita… | 2026-09-25 | Forensic triage | Read → |
| 2026-07-27 | CVE-2026-16812 | VeloCloud Orchestrator Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may co… | 2026-07-30 | Forensic triage | Read → |
| 2026-06-09 | CVE-2026-7473 | Extensible Operating System Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP… | 2026-06-23 | Read → |
Source: CISA Known Exploited Vulnerabilities catalog (public data). Descriptions are CISA's, shortened. Always check the vendor advisory before acting. cisa.gov
Before you patch: three checks
- 01Match the exact version and configuration you run against the vendor advisory. Owning the product is not the same as being exposed.
- 02Check reachability: an exploited flaw on an interface reachable from the internet, or from a compromised workstation, moves to the front of the queue.
- 03Where CISA flags forensic triage, hunt for compromise as well as patch: a fix does not remove an attacker who got in before it.
Questions
How many Arista vulnerabilities are in the CISA KEV catalog?
3 in catalog version 2026.10.21, the first added on 2026-06-09 and the most recent on 2026-09-22. 3 were added in the last 12 months.
Which Arista products have the most exploited vulnerabilities?
By KEV entries: VeloCloud Orchestrator (2), Extensible Operating System (1).
Are Arista vulnerabilities used in ransomware attacks?
None of the 3 Arista entries is marked by CISA as known to be used in ransomware campaigns. That marks what CISA has confirmed, not what is impossible.
Is the next Arista CVE exploitable on your network?
A KEV entry says a vulnerability is exploited somewhere. Zero Hunt answers whether it is exploitable in your environment: an autonomous AI red team on an on-premise appliance, running on private AI, black-box or gray-box, with a human approving every step that matters.
Other vendors: Cisco · Microsoft · Fortinet · Linux kernel · Citrix · GitLab · Adobe · Palo Alto Networks · Check Point · Langflow · Oracle · SonicWall · Ivanti · VMware · Zimbra · SAP · Atlassian · Zyxel · Progress · F5