{"schema_version":1,"title":"Arista Networks vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 15 vulnerabilities in Arista Networks: 0 in the last 7 days and 3 in the last 90 days, 4 of them critical and 1 exploited in the wild. The most recent, CVE-2026-17192, was published on 27 July 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/arista-networks","json_url":"https://junglewise.ai/threats/vendors/arista-networks.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/arista-networks","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":2,"all_time":15,"critical":4,"exploited":1,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":15},"latest":[{"cve":"CVE-2026-17192","cvss":8.5,"slug":"cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input","title":"Arista VeloCloud Orchestrator SSRF due to missing input validation","severity":"high","exploited":false,"published_at":"2026-07-27T17:16:35.573+00:00","url":"https://junglewise.ai/threats/cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input"},{"cve":"CVE-2026-17191","cvss":9.1,"slug":"cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api","title":"Arista VeloCloud Orchestrator SQL injection in flow metrics API","severity":"critical","exploited":false,"published_at":"2026-07-27T17:16:35.407+00:00","url":"https://junglewise.ai/threats/cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api"},{"cve":"CVE-2026-16812","cvss":10,"slug":"cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem","title":"Arista VeloCloud Orchestrator OS command injection in on-prem host","severity":"critical","exploited":true,"published_at":"2026-07-27T16:17:03.64+00:00","url":"https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem"},{"cve":"CVE-2026-25624","cvss":5.7,"slug":"cve-2026-25624-arista-ngfw-administrative-xss-in-dashboard-layout","title":"Arista NGFW administrative XSS in dashboard layout","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:31.16+00:00","url":"https://junglewise.ai/threats/cve-2026-25624-arista-ngfw-administrative-xss-in-dashboard-layout"},{"cve":"CVE-2026-25623","cvss":6,"slug":"cve-2026-25623-arista-ngfw-command-injection-in-browser-management-pipeline","title":"Arista NGFW command injection in browser management pipeline","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.98+00:00","url":"https://junglewise.ai/threats/cve-2026-25623-arista-ngfw-command-injection-in-browser-management-pipeline"},{"cve":"CVE-2026-25622","cvss":6,"slug":"cve-2026-25622-arista-ngfw-command-injection-in-captive-portal-custom-handler","title":"Arista NGFW command injection in Captive Portal Custom Handler","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.82+00:00","url":"https://junglewise.ai/threats/cve-2026-25622-arista-ngfw-command-injection-in-captive-portal-custom-handler"},{"cve":"CVE-2026-25621","cvss":6,"slug":"cve-2026-25621-arista-ngfw-os-command-injection-in-reports-application","title":"Arista NGFW OS command injection in Reports application","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.637+00:00","url":"https://junglewise.ai/threats/cve-2026-25621-arista-ngfw-os-command-injection-in-reports-application"},{"cve":"CVE-2026-25620","cvss":6,"slug":"cve-2026-25620-arista-ngfw-command-injection-in-captive-portal","title":"Arista NGFW command injection in Captive Portal","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.447+00:00","url":"https://junglewise.ai/threats/cve-2026-25620-arista-ngfw-command-injection-in-captive-portal"},{"cve":"CVE-2025-5090","cvss":6.5,"slug":"cve-2025-5090-arista-cvx-denial-of-service-via-improper-input-validation","title":"Arista CVX denial of service via improper input validation","severity":"medium","exploited":false,"published_at":"2026-06-05T17:16:30.347+00:00","url":"https://junglewise.ai/threats/cve-2025-5090-arista-cvx-denial-of-service-via-improper-input-validation"},{"cve":"CVE-2025-5089","cvss":6.5,"slug":"cve-2025-5089-arista-eos-and-cvx-denial-of-service-via-malformed-messages","title":"Arista EOS and CVX denial of service via malformed messages","severity":"medium","exploited":false,"published_at":"2026-06-05T17:16:30.18+00:00","url":"https://junglewise.ai/threats/cve-2025-5089-arista-eos-and-cvx-denial-of-service-via-malformed-messages"},{"cve":"CVE-2025-5088","cvss":8.3,"slug":"cve-2025-5088-arista-cvx-privilege-escalation-to-root-via-redis-session","title":"Arista CVX privilege escalation to root via Redis session","severity":"high","exploited":false,"published_at":"2026-06-05T17:16:29.097+00:00","url":"https://junglewise.ai/threats/cve-2025-5088-arista-cvx-privilege-escalation-to-root-via-redis-session"},{"cve":"CVE-2024-27892","cvss":9.6,"slug":"cve-2024-27892-arista-eos-unauthorized-configuration-change-via-gnmi-set-in","title":"Arista EOS unauthorized configuration change via gNMI Set in OpenConfig","severity":"critical","exploited":false,"published_at":"2026-06-04T23:16:48.117+00:00","url":"https://junglewise.ai/threats/cve-2024-27892-arista-eos-unauthorized-configuration-change-via-gnmi-set-in"},{"cve":"CVE-2024-27891","cvss":5.3,"slug":"cve-2024-27891-arista-eos-acl-enforcement-failure-when-using-macsec","title":"Arista EOS ACL enforcement failure when using MACsec","severity":"medium","exploited":false,"published_at":"2026-06-04T23:16:47.777+00:00","url":"https://junglewise.ai/threats/cve-2024-27891-arista-eos-acl-enforcement-failure-when-using-macsec"},{"cve":"CVE-2024-27890","cvss":9.6,"slug":"cve-2024-27890-arista-eos-unauthorized-configuration-change-via-gnmi-set-in","title":"Arista EOS unauthorized configuration change via gNMI Set in OpenConfig","severity":"critical","exploited":false,"published_at":"2026-06-04T23:16:47.487+00:00","url":"https://junglewise.ai/threats/cve-2024-27890-arista-eos-unauthorized-configuration-change-via-gnmi-set-in"},{"cve":"CVE-2023-5502","cvss":5.9,"slug":"cve-2023-5502-arista-eos-802-1x-authentication-bypass-in-access-ports","title":"Arista EOS 802.1x authentication bypass in access ports","severity":"medium","exploited":false,"published_at":"2026-06-04T23:16:47.21+00:00","url":"https://junglewise.ai/threats/cve-2023-5502-arista-eos-802-1x-authentication-bypass-in-access-ports"}],"vendor":{"hub":true,"name":"Arista Networks","slug":"arista-networks","homepage":"https://www.arista.com/","description":"Arista Networks is an American computer networking company that designs and sells multilayer network switches and software-defined networking solutions.","url":"https://junglewise.ai/threats/vendors/arista-networks"},"weekly":[{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":2,"exploited":1,"vulnerabilities":3},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-16812","cvss":10,"slug":"cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem","title":"Arista VeloCloud Orchestrator OS command injection in on-prem host","severity":"critical","exploited":true,"published_at":"2026-07-27T16:17:03.64+00:00","url":"https://junglewise.ai/threats/cve-2026-16812-arista-velocloud-orchestrator-os-command-injection-in-on-prem"},{"cve":"CVE-2024-27892","cvss":9.6,"slug":"cve-2024-27892-arista-eos-unauthorized-configuration-change-via-gnmi-set-in","title":"Arista EOS unauthorized configuration change via gNMI Set in OpenConfig","severity":"critical","exploited":false,"published_at":"2026-06-04T23:16:48.117+00:00","url":"https://junglewise.ai/threats/cve-2024-27892-arista-eos-unauthorized-configuration-change-via-gnmi-set-in"},{"cve":"CVE-2024-27890","cvss":9.6,"slug":"cve-2024-27890-arista-eos-unauthorized-configuration-change-via-gnmi-set-in","title":"Arista EOS unauthorized configuration change via gNMI Set in OpenConfig","severity":"critical","exploited":false,"published_at":"2026-06-04T23:16:47.487+00:00","url":"https://junglewise.ai/threats/cve-2024-27890-arista-eos-unauthorized-configuration-change-via-gnmi-set-in"},{"cve":"CVE-2026-17191","cvss":9.1,"slug":"cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api","title":"Arista VeloCloud Orchestrator SQL injection in flow metrics API","severity":"critical","exploited":false,"published_at":"2026-07-27T17:16:35.407+00:00","url":"https://junglewise.ai/threats/cve-2026-17191-arista-velocloud-orchestrator-sql-injection-in-flow-metrics-api"},{"cve":"CVE-2026-17192","cvss":8.5,"slug":"cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input","title":"Arista VeloCloud Orchestrator SSRF due to missing input validation","severity":"high","exploited":false,"published_at":"2026-07-27T17:16:35.573+00:00","url":"https://junglewise.ai/threats/cve-2026-17192-arista-velocloud-orchestrator-ssrf-due-to-missing-input"},{"cve":"CVE-2025-5088","cvss":8.3,"slug":"cve-2025-5088-arista-cvx-privilege-escalation-to-root-via-redis-session","title":"Arista CVX privilege escalation to root via Redis session","severity":"high","exploited":false,"published_at":"2026-06-05T17:16:29.097+00:00","url":"https://junglewise.ai/threats/cve-2025-5088-arista-cvx-privilege-escalation-to-root-via-redis-session"},{"cve":"CVE-2025-5090","cvss":6.5,"slug":"cve-2025-5090-arista-cvx-denial-of-service-via-improper-input-validation","title":"Arista CVX denial of service via improper input validation","severity":"medium","exploited":false,"published_at":"2026-06-05T17:16:30.347+00:00","url":"https://junglewise.ai/threats/cve-2025-5090-arista-cvx-denial-of-service-via-improper-input-validation"},{"cve":"CVE-2025-5089","cvss":6.5,"slug":"cve-2025-5089-arista-eos-and-cvx-denial-of-service-via-malformed-messages","title":"Arista EOS and CVX denial of service via malformed messages","severity":"medium","exploited":false,"published_at":"2026-06-05T17:16:30.18+00:00","url":"https://junglewise.ai/threats/cve-2025-5089-arista-eos-and-cvx-denial-of-service-via-malformed-messages"},{"cve":"CVE-2026-25623","cvss":6,"slug":"cve-2026-25623-arista-ngfw-command-injection-in-browser-management-pipeline","title":"Arista NGFW command injection in browser management pipeline","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.98+00:00","url":"https://junglewise.ai/threats/cve-2026-25623-arista-ngfw-command-injection-in-browser-management-pipeline"},{"cve":"CVE-2026-25622","cvss":6,"slug":"cve-2026-25622-arista-ngfw-command-injection-in-captive-portal-custom-handler","title":"Arista NGFW command injection in Captive Portal Custom Handler","severity":"medium","exploited":false,"published_at":"2026-06-05T20:17:30.82+00:00","url":"https://junglewise.ai/threats/cve-2026-25622-arista-ngfw-command-injection-in-captive-portal-custom-handler"}],"generated_at":"2026-09-28T03:07:00.154823+00:00","technologies":[{"name":"Arista Networks Next Generation Firewall","slug":"next-generation-firewall","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/next-generation-firewall"},{"name":"Arista Networks Cloudvision-Exchange","slug":"cloudvision-exchange","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/cloudvision-exchange"},{"name":"Arista Networks VeloCloud Orchestrator","slug":"velocloud-orchestrator-on-prem","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/velocloud-orchestrator-on-prem"}]}