Is CVE-2026-102165 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102165 being exploited in the wild.

How severe is CVE-2026-102165?

High severity, with a CVSS score of 7.5, published 6 October 2026.

Which products and versions are affected?

Arista Wi-Fi Access Point 22.0.1F-32 and below in 22.x train; 21.3.0M-13 and below in 21.x train; all prior releases.

How is CVE-2026-102165 attacked?

It is attacked over the network.

Am I affected by CVE-2026-102165?

Check whether you run Arista Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102165: Arista Wi-Fi Access Point stack-based buffer overflow in capture service

CVE-2026-102165 · Severity: high · CVSS 7.5 · Published 2026-10-06

Arista Wi-Fi access points contain a vulnerability in their packet capture service that allows an unauthenticated attacker to crash the service or execute arbitrary code by sending a specially crafted network packet. The vulnerability only affects deployments actively using a non-default "Wireshark on local machine" capture mode, and requires the attacker to have network access to the capture service during an active capture session. Organizations should upgrade to patched releases or switch to the "Upload to server" streaming option to mitigate risk.

Technologies: Arista Wi-Fi Access Point. Vendors: Arista.

Quick answers

Is CVE-2026-102165 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102165 being exploited in the wild.
How severe is CVE-2026-102165?: High severity, with a CVSS score of 7.5, published 6 October 2026.
Which products and versions are affected?: Arista Wi-Fi Access Point 22.0.1F-32 and below in 22.x train; 21.3.0M-13 and below in 21.x train; all prior releases.
Is there a fix for CVE-2026-102165?: Yes: fixed in Wi-Fi Access Point 22.1.1F-61 and later in the 22.x train, 21.4.0M-12 and later in the 21.x train. Until then: Use "Upload to server" as the streaming option instead of the vulnerable "Wireshark on local machine" mode when performing Live Packet Capture operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102165 attacked?: It is attacked over the network.
Am I affected by CVE-2026-102165?: Check whether you run Arista Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Wi-Fi Access Point 22.1.1F-61 and later in the 22.x train, 21.4.0M-12 and later in the 21.x train

Use "Upload to server" as the streaming option instead of the vulnerable "Wireshark on local machine" mode when performing Live Packet Capture operations.

Technical details

A stack-based buffer overflow (CWE-121) in the Arista Wi-Fi access point capture service allows unauthenticated remote code execution when a crafted packet is sent to an active capture session using the non-default "Wireshark on local machine" streaming mode. The attack requires network access to the capture service and an active Live Packet Capture session; the service only listens while a capture is in progress. An attacker can cause denial of service or potentially achieve RCE.

Affected products

Arista Wi-Fi Access Point 22.0.1F-32 and below in 22.x train; 21.3.0M-13 and below in 21.x train; all prior releases

Timeline

2026-10-06: disclosed

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.