CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,463
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product arista_networks:eos. Show all products

43 CVEs, showing 1 to 43
CVESeverityTitlePublished
CVE-2025-3456Low 3.8On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
Assigned by Arista
Aug 25, 2025
CVE-2026-7473
Known exploited
Medium 5.8Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Assigned by Arista
Jun 5, 2026
CVE-2026-73449Medium 5.9On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI
Assigned by Arista
Sep 14, 2026
CVE-2026-77191Low 2.6All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an
Assigned by Arista
Sep 14, 2026
CVE-2026-75943Low 2.6A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcem
Assigned by Arista
Sep 14, 2026
CVE-2026-75944Low 2.6A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User
Assigned by Arista
Sep 14, 2026
CVE-2026-75945Low 2.6A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.
Assigned by Arista
Sep 14, 2026
CVE-2026-73451Medium 4.8On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can
Assigned by Arista
Sep 15, 2026
CVE-2026-19641Medium 5.3On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit
Assigned by Arista
Sep 15, 2026
CVE-2026-73465Medium 6.3On affected platforms running Arista EOS, under certain circumstances plaintext private keys
Assigned by Arista
Sep 15, 2026
CVE-2026-73466Medium 6.3On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
Assigned by Arista
Sep 15, 2026
CVE-2026-73467Medium 6.3On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
Assigned by Arista
Sep 15, 2026
CVE-2026-73458High 8.2On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou
Assigned by Arista
Sep 15, 2026
CVE-2026-19655Medium 6.5On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent
Assigned by Arista
Sep 15, 2026
CVE-2026-73437Critical 9.6On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
Assigned by Arista
Sep 15, 2026
CVE-2026-73444Medium 4.7On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the
Assigned by Arista
Sep 15, 2026
CVE-2026-73446High 7.4Security Advisory 0160
Assigned by Arista
Sep 15, 2026
CVE-2026-73459High 7.4Security Advisory 0160
Assigned by Arista
Sep 15, 2026
CVE-2026-73460Medium 6.1Security Advisory 0160
Assigned by Arista
Sep 15, 2026
CVE-2026-73450Medium 6.9Security Advisory 0161
Assigned by Arista
Sep 16, 2026
CVE-2026-73447Critical 9.1Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
Assigned by Arista
Sep 16, 2026
CVE-2026-73461High 8.0Security Advisory 0163
Assigned by Arista
Sep 16, 2026
CVE-2026-73439High 7.5Security Advisory 0164
Assigned by Arista
Sep 16, 2026
CVE-2026-73454High 8.1Security Advisory 0165
Assigned by Arista
Sep 16, 2026
CVE-2026-73464High 8.8Security Advisory 0166
Assigned by Arista
Sep 16, 2026
CVE-2026-2380High 7.4Security Advisory 0168
Assigned by Arista
Sep 16, 2026
CVE-2026-73445Medium 4.9Security Advisory 0167
Assigned by Arista
Sep 16, 2026
CVE-2026-73463Medium 5.3Security Advisory 0169
Assigned by Arista
Sep 16, 2026
CVE-2026-19640Medium 4.2Security Advisory 0170
Assigned by Arista
Sep 16, 2026
CVE-2026-73435High 8.2Security Advisory 0171
Assigned by Arista
Sep 16, 2026
CVE-2026-73436Medium 6.5Security Advisory 0171
Assigned by Arista
Sep 16, 2026
CVE-2026-73438Medium 5.3Security Advisory 0172
Assigned by Arista
Sep 16, 2026
CVE-2026-73455High 7.5Security Advisory 0173
Assigned by Arista
Sep 16, 2026
CVE-2026-73453Critical 10.0Security Advisory 0174
Assigned by Arista
Sep 16, 2026
CVE-2026-73469Medium 5.8Security Advisory 0176
Assigned by Arista
Sep 16, 2026
CVE-2026-73440Medium 4.2Security Advisory 0178
Assigned by Arista
Sep 16, 2026
CVE-2026-73468Medium 6.5Security Advisory 0175
Assigned by Arista
Sep 16, 2026
CVE-2026-77190Medium 6.5Security Advisory 0177
Assigned by Arista
Sep 16, 2026
CVE-2026-73443Medium 4.7On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
Assigned by Arista
Sep 16, 2026
CVE-2026-73442Low 3.0On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for
Assigned by Arista
Sep 16, 2026
CVE-2026-73456Critical 10.0Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
Assigned by Arista
Sep 16, 2026
CVE-2026-73457Medium 5.3Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.
Assigned by Arista
Sep 16, 2026
CVE-2026-73462Medium 6.5On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I
Assigned by Arista
Sep 16, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.