Technology · Arista
Arista EOS vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 73 vulnerabilities in Arista EOS: 24 in the last 7 days and 65 in the last 90 days, 9 of them critical and 1 exploited in the wild. The most recent, CVE-2026-121371, was published on 10 November 2026. Nothing in the last four weeks, down from 41 vulnerabilities in the four before. 0 critical against 4.
- Last 7 days
- 24
- Last 90 days
- 65
- Critical, all time
- 9
- Exploited in the wild
- 1
About Arista EOS
Arista EOS is a network operating system for switches and routing devices.
Latest Arista EOS vulnerabilities
- CVE-2026-121371: Arista EOS path traversal in eAPI servicehighCVSS 7.5
- CVE-2026-121370: Arista EOS denial of service in PTPhighCVSS 8.6
- CVE-2026-121369: Arista EOS denial of service via resource exhaustionmediumCVSS 5.3
- CVE-2026-121368: Arista EOS BFD authentication out-of-bounds writehighCVSS 8.6
- CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfacescriticalCVSS 9.6
- CVE-2026-121295: Arista EOS kernel crash via crafted S-BFD PDUhighCVSS 8.6
- CVE-2026-121294: Arista EOS S-BFD reflector proxy denial of servicemediumCVSS 5.3
- CVE-2026-121293: Arista EOS BGP denial of service in Dynamic Path SelectionmediumCVSS 4.4
- CVE-2026-121292: Arista EOS out-of-bounds read in RPKI Error Report handlinghighCVSS 8.2
- CVE-2026-121291: Arista EOS RPKI error report denial of servicehighCVSS 8.2
- CVE-2026-121290: Arista EOS BGP ACL bypass on custom listen porthighCVSS 8.2
- CVE-2026-121289: Arista EOS BGP agent crash via crafted packetcriticalCVSS 9.8
- CVE-2026-121288: Arista EOS RIPv2 MD5 authentication bypasshighCVSS 8.1
- CVE-2026-121287: Arista EOS RIPv2 buffer underflow and authentication bypasshighCVSS 8.8
- CVE-2026-121286: Arista EOS BGP process crash via crafted SR-TE packetsmediumCVSS 6.5
- CVE-2026-120983: Arista EOS improper access control with 802.1x and Policy Based RoutinghighCVSS 7.6
- CVE-2026-120982: Arista EOS BGP session reset denial of servicehighCVSS 7.5
- CVE-2026-120981: Arista EOS VPLS-BGP route advertisement disruptionmediumCVSS 5.3
- CVE-2026-120980: Arista EOS BGP agent denial of service in VPLS-BGPmediumCVSS 5.3
- CVE-2026-120979: Arista EOS improper validation in BGP-LS path selectionhighCVSS 8.1
- CVE-2026-120978: Arista EOS denial of service in BGP-LSmediumCVSS 6.5
- CVE-2026-120977: Arista EOS DHCP device profiling spoofing in 802.1XhighCVSS 8.2
- CVE-2026-120976: Arista EOS sensitive data exposure in diagnostic logs during SSUmediumCVSS 6
- CVE-2026-120974: Arista EOS IPsec anti-replay window bypass in AutoVPNmediumCVSS 5.3
- CVE-2026-73462: Arista EOS IGMP snooping denial of service via malformed packetsmediumCVSS 6.5EPSS 0.3%
Most severe Arista EOS vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-7473: Arista EOS improper tunnel protocol verification in decapsulationcriticalexploited in the wildCVSS 5.8EPSS 0.0%
- CVE-2026-73456: Arista EOS gNPSI arbitrary code executioncriticalCVSS 10EPSS 0.7%
- CVE-2026-73453: Arista EOS P4Runtime arbitrary code executioncriticalCVSS 10EPSS 0.7%
- CVE-2026-121289: Arista EOS BGP agent crash via crafted packetcriticalCVSS 9.8
- CVE-2026-73437: Arista EOS DHCP relay source validation bypasscriticalCVSS 9.6EPSS 0.2%
- CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfacescriticalCVSS 9.6
- CVE-2024-27892: Arista EOS unauthorized configuration change via gNMI Set in OpenConfigcriticalCVSS 9.6
- CVE-2024-27890: Arista EOS unauthorized configuration change via gNMI Set in OpenConfigcriticalCVSS 9.6
- CVE-2026-73447: Arista EOS privilege escalation in gNSI CertzcriticalCVSS 9.1EPSS 0.7%
- CVE-2026-73464: Arista EOS code injection in gNMI interfacehighCVSS 8.8EPSS 0.6%
Vulnerabilities per week
Nothing in the last four weeks, down from 41 vulnerabilities in the four before. 0 critical against 4. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 41 | 4 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 24 | 2 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Arista EOS vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/eos)<a href="https://junglewise.ai/threats/technologies/eos"><img src="https://junglewise.ai/threats/technologies/eos/badge.svg" alt="Arista EOS vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/eos.json, and this page as text at https://junglewise.ai/threats/technologies/eos.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Arista EOS vulnerabilities", https://junglewise.ai/threats/technologies/eos, 11 November 2026.