Arista vulnerabilities
Security vulnerabilities in Arista products, including the VeloCloud Orchestrator SD-WAN platform. Management-plane flaws in SD-WAN infrastructure carry broad network impact across every connected site.
We track 3 Arista CVEs, 3 of them on CISA's Known Exploited Vulnerabilities catalog. The latest KEV addition is CVE-2026-93952, added .
- CVEs tracked
- 3
- On CISA KEV
- 3
- Ransomware use
- 0
- Rated critical
- 2
Latest Arista coverage
Our reporting filed under Arista, plus any story that cites one of its CVEs.
CISA: Collabora and VeloCloud Flaws Hit KEV
CISA added CVE-2026-110447 and CVE-2026-114625 to its KEV catalog on October 23, giving federal agencies until October 26 to patch. Both are confirmed exploited.
Arista VeloCloud Zero-Day CVE-2026-114625 Exploited
A CVSS 9.9 SQL injection flaw in Arista VeloCloud Orchestrator on-prem is under active attack. Patches are out. Hosted instances are already fixed.
Arista VeloCloud CVSS 10.0 Flaw Added to CISA KEV
CISA added CVE-2026-93952, a CVSS 10.0 unauthenticated RCE flaw in Arista VeloCloud Orchestrator, to its KEV catalog September 22. Federal agencies have until September 25 to patch.
Arista VeloCloud CVE-2026-16812 Hits KEV, Patch Now
Arista VeloCloud Orchestrator has a CVSS 10.0 OS command injection flaw under active exploitation. CISA added it to KEV July 27. Patch on-prem deployments now.
Known exploited Arista vulnerabilities
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-93952 Arista VeloCloud Orchestrator Unauthenticated RCEwrite-up | [ CRITICAL ] | 10.0 | 1.4% | ||
| CVE-2026-16812 Arista VeloCloud Orchestrator OS Command Injectionwrite-up | [ CRITICAL ] | 10.0 | 1.8% | ||
| CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | [ MEDIUM ] | 5.8 | 1.1% |
Every Arista CVE on CISA's KEV catalog that we hold, newest KEV addition first. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else.
Machine-readable: /api/v1/vendors/arista.json.
Every CVE row links to its record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker, the vendor scorecard, or all vendors.