Arista Networks EOS vulnerabilities, page 4

76 vulnerabilities

Known vulnerabilities in Arista Networks EOS, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.4HighCVE-2026-2380arista networks · eosSecurity Advisory 0168On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.EPSS0.25%2.6LowCVE-2026-77191arista networks · eosAll of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on anAn authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.EPSS0.22%6.5MediumCVE-2026-77190arista networks · eosSecurity Advisory 0177On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.EPSS0.28%4.2MediumCVE-2026-19640arista networks · eosSecurity Advisory 0170On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.EPSS0.19%6.9MediumCVE-2026-19641arista networks · eosOn affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.EPSS0.34%7.1HighCVE-2026-19655arista networks · eosOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthentOn affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.EPSS0.19%6.9MediumCVE-2026-7473arista networks · eosArista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding BypassOn affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.KEVEPSS0.65%2.6LowCVE-2026-75943arista networks · eosA brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemEPSS0.20%2.6LowCVE-2026-75945arista networks · eosA race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.EPSS0.20%5.6MediumCVE-2026-75944arista networks · eosA race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserUser interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.EPSS0.22%8.2HighCVE-2023-5502arista networks · eosOn affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.EPSS0.32%6.5MediumCVE-2023-24548arista networks · eos +1 moreOn affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packetsThe device will continue to be susceptible to the issue until remediation is in place.EPSS0.48%7.5HighCVE-2023-24511arista networks · eos +1 moreOn affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.This may result in the snmpd processing being terminated (causing SNMP requests to time out until snmpd is automatically restarted) and potential memory resource exhaustion for other processes on the switch. The vulnerability does not have any confidentiality or integrity impacts to the system.EPSS0.84%7.5HighCVE-2023-24545arista networks · eos +1 moreOn affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.EPSS0.78%7.5HighCVE-2023-24513arista networks · eos +1 moreOn affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ...On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. This causes a leak of packet buffers and if enough malformed packets are received, the switch may eventually stop forwarding traffic.EPSS0.68%7.5HighCVE-2023-3646arista networks · eos +1 moreOn affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.EPSS0.67%