Quick answers
- Is CVE-2025-5089 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-5089 being exploited in the wild.
- How severe is CVE-2025-5089?
- Medium severity, with a CVSS score of 6.5, published 5 June 2026.
- Which products and versions are affected?
- Arista Networks EOS; Arista Networks CloudVision eXchange (CVX).
- Is there a fix for CVE-2025-5089?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-5089 attacked?
- It is attacked over the network, in an operating system.
- Am I affected by CVE-2025-5089?
- Check whether you run Arista Networks CloudVision eXchange. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is classified as improper input validation (CWE-20) within the communication protocol between Arista EOS switches and CVX servers. When a malformed message is received, it can trigger a Sysdb agent crash on the EOS device, resulting in a soft reset, or cause agent crashes on the CVX server, leading to cluster instability. Exploitation requires the attacker to have high-privileged access to a device already participating in the CVX cluster to inject custom TCP packets. Only EOS switches actively connected to a CVX server are impacted; standalone switches are not vulnerable.
Affected products
- Arista Networks EOS
- Arista Networks CloudVision eXchange (CVX)
Timeline
- 2026-06-05: disclosed
- 2026-06-05: advisory