CVE-2026-86107

Security Advisory 0180

The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only. A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Velocloud Velocloud Gateway

CVE-2026-86106

Security Advisory 0179

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Velocloud Edge

CVE-2026-31431

crypto: algif_aead - Revert to operating out-of-place

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.

CVSS 3.1 · 7.8 High EPSS 98.1% KEV · Listed

Vendors

Amazon Arista Canonical and 7 more

Products

Amazon Linux Cloudvision Agni Cloudvision Portal and 57 more

CVE-2026-16812

VeloCloud Orchestrator OS Command Injection

VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. This functionality was intended to be for internal use only and is not intended to be remotely accessible. Hosted and Dedicated versions of VCO have already been patched in advance of this notice going out. This issue was discovered externally and is known to be actively exploited.

CVSS 4.0 · 10 Critical EPSS 1.8% KEV · Listed

Vendors

Arista Arista Networks

Products

Velocloud Orchestrator Velocloud Orchestrator On-prem

CVE-2026-7473

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

CVSS 4.0 · 6.9 Medium EPSS 1.1% KEV · Listed

Vendors

Arista

Products

7020sr-24c2 7020sr-32c2 7020srg-24c2 and 99 more

CVE-2025-5089

Arista EOS SysDB Agent Denial of Service via Malformed CVX Client/Server Messages

In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Exchange

CVE-2025-5090

Arista CloudVision Exchange Cluster Instability via Unexpected Switch Messages

CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Exchange

CVE-2025-5088

Arista CloudVision Exchange (CVX) Cluster Privilege Escalation via MCS Redis Session

An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Cloudvision Exchange

CVE-2026-2379

Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled

On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with existing Security Associations, resulting in sequence number mismatches between tunnel endpoints potentially causing unstable communication.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-25620

Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection

An encrypted password command injection vulnerability exists in the Captive Portal application framework of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

CVSS 4.0 · 7 High EPSS 9.3% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25621

Arista Edge Threat Management NGFW Reports Application Insecure Input Validation

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25622

Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

CVSS 4.0 · 7 High EPSS 9.3% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25623

Arista Edge Threat Management NGFW UI Arbitrary Command Execution

An input validation command execution vulnerability exists in the browser management pipeline of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Authenticated administrators can leverage this exposure to obtain underlying terminal script code processing execution permissions.

CVSS 4.0 · 7 High EPSS 5.6% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2026-25624

Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Edge Threat Management Ng Firewall

CVE-2024-6858

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2025-8873

Arista EOS Dataplane Denial of Service via Malformed IPsec Packet

On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2023-5502

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2024-27892

On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2024-27890

On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).

Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVSS 4.0 · 7.2 High EPSS 4.4% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2024-27891

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos