Vendor
Arista vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 100 vulnerabilities in Arista: 25 in the last 7 days and 95 in the last 90 days, 12 of them critical and 2 exploited in the wild. The most recent, CVE-2026-121371, was published on 10 November 2026. 1 vulnerability in the last four weeks, down 99% on the four before (69). 1 critical against 8, 1 exploited in the wild against 0. 7 technologies have a page of their own.
- Last 7 days
- 25
- Last 90 days
- 95
- Critical, all time
- 12
- Exploited in the wild
- 2
About Arista
A networking technology company that designs and sells multilayer network switches and software-defined networking solutions.
Arista technologies
Latest Arista vulnerabilities
- CVE-2026-121371: Arista EOS path traversal in eAPI servicehighCVSS 7.5
- CVE-2026-121370: Arista EOS denial of service in PTPhighCVSS 8.6
- CVE-2026-121369: Arista EOS denial of service via resource exhaustionmediumCVSS 5.3
- CVE-2026-121368: Arista EOS BFD authentication out-of-bounds writehighCVSS 8.6
- CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfacescriticalCVSS 9.6
- CVE-2026-121295: Arista EOS kernel crash via crafted S-BFD PDUhighCVSS 8.6
- CVE-2026-121294: Arista EOS S-BFD reflector proxy denial of servicemediumCVSS 5.3
- CVE-2026-121293: Arista EOS BGP denial of service in Dynamic Path SelectionmediumCVSS 4.4
- CVE-2026-121292: Arista EOS out-of-bounds read in RPKI Error Report handlinghighCVSS 8.2
- CVE-2026-121291: Arista EOS RPKI error report denial of servicehighCVSS 8.2
- CVE-2026-121290: Arista EOS BGP ACL bypass on custom listen porthighCVSS 8.2
- CVE-2026-121289: Arista EOS BGP agent crash via crafted packetcriticalCVSS 9.8
- CVE-2026-121288: Arista EOS RIPv2 MD5 authentication bypasshighCVSS 8.1
- CVE-2026-121287: Arista EOS RIPv2 buffer underflow and authentication bypasshighCVSS 8.8
- CVE-2026-121286: Arista EOS BGP process crash via crafted SR-TE packetsmediumCVSS 6.5
- CVE-2026-120983: Arista EOS improper access control with 802.1x and Policy Based RoutinghighCVSS 7.6
- CVE-2026-120982: Arista EOS BGP session reset denial of servicehighCVSS 7.5
- CVE-2026-120981: Arista EOS VPLS-BGP route advertisement disruptionmediumCVSS 5.3
- CVE-2026-120980: Arista EOS BGP agent denial of service in VPLS-BGPmediumCVSS 5.3
- CVE-2026-120979: Arista EOS improper validation in BGP-LS path selectionhighCVSS 8.1
- CVE-2026-120978: Arista EOS denial of service in BGP-LSmediumCVSS 6.5
- CVE-2026-120977: Arista EOS DHCP device profiling spoofing in 802.1XhighCVSS 8.2
- CVE-2026-120976: Arista EOS sensitive data exposure in diagnostic logs during SSUmediumCVSS 6
- CVE-2026-120974: Arista EOS IPsec anti-replay window bypass in AutoVPNmediumCVSS 5.3
- CVE-2026-102166: Arista C-260 and C-250 hardcoded cryptographic keys in firmware verificationhighCVSS 8.8
Most severe Arista vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-114625: Arista VeloCloud Orchestrator privilege escalationcriticalexploited in the wildCVSS 9.9EPSS 0.6%
- CVE-2026-7473: Arista EOS improper tunnel protocol verification in decapsulationcriticalexploited in the wildCVSS 5.8EPSS 0.0%
- CVE-2026-73456: Arista EOS gNPSI arbitrary code executioncriticalCVSS 10EPSS 0.7%
- CVE-2026-73453: Arista EOS P4Runtime arbitrary code executioncriticalCVSS 10EPSS 0.7%
- CVE-2026-121289: Arista EOS BGP agent crash via crafted packetcriticalCVSS 9.8
- CVE-2026-102159: Arista CloudVision-CUE access control bypass in backendcriticalCVSS 9.8
- CVE-2026-86106: Arista VeloCloud Edge HA authentication bypasscriticalCVSS 9.6EPSS 0.4%
- CVE-2026-73437: Arista EOS DHCP relay source validation bypasscriticalCVSS 9.6EPSS 0.2%
- CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfacescriticalCVSS 9.6
- CVE-2026-73447: Arista EOS privilege escalation in gNSI CertzcriticalCVSS 9.1EPSS 0.7%
Vulnerabilities per week
1 vulnerability in the last four weeks, down 99% on the four before (69). 1 critical against 8, 1 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 45 | 5 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 24 | 3 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 1 | 1 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 25 | 2 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Arista vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/arista)<a href="https://junglewise.ai/threats/vendors/arista"><img src="https://junglewise.ai/threats/vendors/arista/badge.svg" alt="Arista vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/arista.json, and this page as text at https://junglewise.ai/threats/vendors/arista.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Arista vulnerabilities", https://junglewise.ai/threats/vendors/arista, 11 November 2026.