CVE-2026-102167

Security Advisory 0197

On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Wi-fi Access Points

CVE-2026-102165

Security Advisory 0198

On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Wi-fi Access Points

CVE-2026-101158

Security Advisory 0185

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101149

Security Advisory 0186

Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101150

Security Advisory 0186

Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101151

Security Advisory 0187

Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101152

Security Advisory 0187

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101154

Security Advisory 0189

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2026-101155

Security Advisory 0189

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Portal

CVE-2020-26144

kernel: accepting unencrypted A-MSDU frames that start with RFC1042 header

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (i.e., LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

CVSS 3.1 · 6.5 Medium EPSS 4.9% KEV · Not listed

Vendors

Arista Redhat Samsung and 1 more

Products

C-100 C-100 Firmware C-110 and 34 more

CVE-2020-26140

kernel: accepting plaintext data frames in protected networks

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

CVSS 3.1 · 6.5 Medium EPSS 2.9% KEV · Not listed

Vendors

Alfa Arista Cisco and 3 more

Products

Awus036h Awus036h Firmware C-100 and 386 more

CVE-2020-3702

kernel: ath9k: information disclosure via specifically timed and handcrafted traffic

u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MSM8909W, MSM8996AU, QCA9531, QCN5502, QCS405, SDX20, SM6150, SM7150

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Arista Debian Qualcomm

Products

Access Point Av2 C-75 and 27 more

CVE-2026-73446

Security Advisory 0160

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-73459

Security Advisory 0160

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-73460

Security Advisory 0160

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-73450

Security Advisory 0161

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-86108

Security Advisory 0181

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Velocloud Edge

CVE-2026-86109

Security Advisory 0182

The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Velocloud Edge

CVE-2026-93952

Security Advisory 0183

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

CVSS 4.0 · 9.5 Critical EPSS 1.4% KEV · Listed

Vendors

Arista Arista Networks

Products

Velocloud Orchestrator Velocloud Orchestrator On-prem

CVE-2026-73443

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos