Skip to content
feed: live
>_0dayNews
← All vendors
Vendor

Arista

Security vulnerabilities in Arista products, including the VeloCloud Orchestrator SD-WAN platform. Management-plane flaws in SD-WAN infrastructure carry broad network impact across every connected site.

2 CVEs1 articlesRSS
CVEs
CVE-2026-16812
[ CRITICAL ]CVSS 10.0EPSS 0.9%kev

Arista VeloCloud Orchestrator OS Command Injection

CVSS 10.0 critical. Remote attackers can inject OS commands into Arista VeloCloud Orchestrator On-Prem, compromising the SD-WAN management plane.

Arista / VeloCloud Orchestrator On-Prem
CVE-2026-7473
[ MEDIUM ]CVSS 5.8EPSS 1.1%kev

Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

Arista / Extensible Operating System
Articles
~/articles/2026-07-27-arista-velocloud-cve-2026-16812-kev
Arista VeloCloud CVE-2026-16812 Hits KEV, Patch Now
arista

Arista VeloCloud CVE-2026-16812 Hits KEV, Patch Now

Arista VeloCloud Orchestrator has a CVSS 10.0 OS command injection flaw under active exploitation. CISA added it to KEV July 27. Patch on-prem deployments now.

read →