Vendor
Arista
- CVEs tracked · all time
- 11
- in CISA KEV · all time
- 4
- articles · since 11 Sep
- 12
- articles · all time
- 28
12 articles since 11 Sep; 2 CISA notices, marked below the bars.
Show as table
| Day (UTC) | Articles |
|---|---|
| Tue 22 Sep | 2 |
| Wed 23 Sep | 2 |
| Thu 24 Sep | 1 |
| Thu 22 Oct | 2 |
| Fri 23 Oct | 3 |
| Sat 24 Oct | 2 |
Products: Extensible Operating System, VeloCloud Orchestrator, VeloCloud Orchestrator (VCO) On-Prem, VeloCloud Orchestrator On-Prem
CVEs
11 CVEsCVE-2026-114625Arista VeloCloud Orchestrator SQL Injection VulnerabilityCVSS9.9CriticalExploited0.8%EPSS7articles
CVE-2026-93952Arista VeloCloud Orchestrator Improper Input Validation VulnerabilityCVSS10.0CriticalExploited1.1%EPSS6articles
CVE-2026-16812Arista VeloCloud Orchestrator On-Prem OS Command Injection VulnerabilityCVSS10.0CriticalExploited1.0%EPSS8articles
CVE-2026-7473Arista Extensible Operating System Incomplete Comparison with Missing Factors VulnerabilityCVSS6.9MediumExploited0.7%EPSS7articles
CVE-2026-73456Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.CVSS10.0Critical–Not in KEV0.7%EPSS1article
CVE-2026-73447Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate RequestCVSS9.1Critical–Not in KEV0.7%EPSS1article
CVE-2026-17191VeloCloud Orchestrator Flow Metrics API SQL InjectionCVSS9.1Critical–Not in KEV0.3%EPSS1article
CVE-2026-17192VeloCloud Orchestrator Missing Input Validation SSRFCVSS8.5High–Not in KEV0.3%EPSS1article
- CISA flags exploited Arista VeloCloud flaw that lets attackers impersonate superusersSecurity Affairs
- CISA Warns of Active Attacks on Nextcloud and Arista FlawsThe Hacker News
- CISA Confirms Active Attacks on Arista VeloCloud OrchestratorCISA · official notice
- Arista VeloCloud Flaw Marks Third Exploited Orchestrator Zero-DaySecurityWeek
- Arista VeloCloud Orchestrators Hit by Exploited SQL Injection FlawSOCRadar
- Arista VeloCloud Zero Day Exploited to Gain Superuser AccessThe Hacker News
- Arista VeloCloud flaw under attack lets users seize superuser accessSecurityOnline
- Critical Flaws Put VeloCloud, BIG-IP and Rancher Systems at RiskSecurityOnline
- CISA Warns of Active Attacks on Check Point and F5 FlawsSecurity Affairs
- Arista Patches Actively Exploited VeloCloud Orchestrator Zero-DaySecurityWeek
- CISA Warns of Active Attacks on Critical VeloCloud FlawCISA · official notice
- Arista Warns Attackers Are Exploiting Critical VeloCloud FlawSecurityOnline
- Arista Fixes Critical EOS Flaws Enabling Unauthenticated Code ExecutionSecurityOnline
- Attackers Exploit VMware, WordPress Zero Days in New CVE WaveSecurityOnline
- U.S. CISA adds Arista VeloCloud Orchestrator and Fortinet FortiOS flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
- Critical Arista VeloCloud Orchestrator Vulnerability Exploited as Zero-DaySecurityWeek
- CISA KEV Catalog Flags CVE-2026-16812 in Arista VeloCloudCISA · official notice
- OS command injection flaw hits Arista VeloCloud, CISA issues alertCISA · official notice
- CISA adds Arista VeloCloud RCE and Fortinet FortiOS bypass to KEVSecurityOnline
- Arista Warns of Actively Exploited VeloCloud Orchestrator BugSecurityOnline
- CISA flags Arista, Chrome, Cisco flaws; patch by June 23Security Affairs
- Havoc Stager Uses Fake Invoices to Hit South American FirmsSecurityOnline
- Architectural Exposure: Developers Extract Apple’s Subterranean Core Prompts for Siri AISecurityOnline
- Critical Check Point VPN Flaw Under Active Attack Amid New CVEsSecurityOnline
- Arista zero day EOS flaw exploited, CISA urges mitigationSecurityWeek
- CISA warns of critical flaws in Chromium, Arista and Cisco gearSecurityOnline
- CISA Adds Arista EOS Flaw to KEV Catalog, Urges PatchCISA · official notice
- CISA confirms active exploitation of Arista EOS CVE-2026-7473 flawCISA · first in our coverage · official notice