CVE-2026-101152 is an open redirect vulnerability in Arista Networks CloudVision Portal's Single Sign-On (SSO) login flow. It allows a remote, unauthenticated attacker to craft a URL that causes the identity provider to send authentication material to an attacker-controlled URL instead of the legitimate CloudVision service. This vulnerability affects multiple versions of CloudVision Portal from 2021.1.0 through 2026.2.0. The CVSS score is 8.0, indicating high severity due to the potential for complete compromise of authentication credentials. No explicit patch information is provided, and no known exploits are reported in the wild.
CVE-2026-101151 is an open redirect vulnerability in Arista Networks CloudVision Portal. It occurs due to insufficient validation of URLs in the login flow, allowing unauthenticated attackers to redirect users to arbitrary external sites after authentication. This vulnerability has a medium severity with a CVSS score of 4.3 and could be leveraged in phishing or social engineering attacks.
CVE-2026-101150 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of OIDC bearer token configuration, enabling users with specific high privileges to direct requests to arbitrary destinations. The vulnerability has a medium severity rating with a CVSS score of 4.1. No known exploits in the wild have been reported. There is no available information on patches or remediation.
CVE-2026-101149 is a server-side request forgery (SSRF) vulnerability in Arista Networks CloudVision Portal. It results from insufficient validation of the OpenID Connect (OIDC) single sign-on provider configuration. A user with specific high privileges could exploit this to send requests to arbitrary destinations. The vulnerability has a medium severity with a CVSS score of 4.1. It affects multiple versions of CloudVision Portal from 2020.3.0 through 2026.1.2 and version 2026.2.0. No known exploits are reported in the wild. No patch or remediation details are currently available.
CVE-2026-101158 is a stored cross-site scripting (XSS) vulnerability in the Fileserver upload API of Arista Networks CloudVision Portal. It affects multiple versions including 1.0.0 through 2026.1.2 and version 2026.2.0. An authenticated attacker with file upload privileges can exploit this flaw to execute malicious scripts in the context of other users' browsers. Successful exploitation could allow session hijacking and potentially grant full access to the victim's account and administrative permissions.
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVE-2026-73462 is an out-of-bounds read vulnerability in Arista Networks EOS affecting the IGMP snooping feature, which is enabled by default on all VLANs. An unauthenticated network-adjacent attacker can send malformed packets to cause the IGMP snooping agent to crash temporarily. This disruption results in multicast traffic being flooded to all ports on the affected VLAN until the service recovers. Repeated exploitation could cause prolonged multicast forwarding issues.
CVE-2026-73457 is a vulnerability in Arista Networks EOS where gNPSI client credentials may be logged in clear text in local or remote accounting logs on affected versions. This exposure occurs when the gRPC Network Packet Sampling Interface (gNPSI) is enabled, potentially allowing authenticated users to access sensitive credential information. The vulnerability affects specific versions of EOS and has a medium severity rating with a CVSS score of 5.3.
CVE-2026-73456 is a critical vulnerability in Arista Networks EOS affecting versions 4.34.2F through 4.34.7M, 4.35.0 through 4.35.5M, and 4.36.0 through 4.36.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Packet Sampling Interface (gNPSI). An unauthenticated attacker can exploit this flaw to execute arbitrary code, gaining full administrative control over the affected switch.
CVE-2026-73442 is a vulnerability in Arista Networks EOS affecting versions 4.33.0 through 4.33.9M, 4.34.0 through 4.34.7M, 4.35.0 through 4.35.5M, and 4.36.0 through 4.36.1F. On platforms with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext. This allows an authenticated user with sufficient privileges to access agent trace logs or forwarded log outputs and obtain these credentials without needing access to the VRRP network segment. The CVSS 3.1 base score is 3.0, indicating low severity. There are no known exploits in the wild and no patch links provided in the input data.
CVE-2026-73443 is an authentication bypass vulnerability in Arista Networks EOS affecting VRRPv2 IP-AH authentication. An unauthenticated attacker on the same layer 2 network segment can capture and replay legitimate VRRP advertisements indefinitely. This replay can cause stale VRRP state to be advertised, preventing backup routers from taking over the virtual gateway after the master router fails, resulting in denial of service for hosts relying on the virtual gateway.
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
CVE-2026-73453 is a critical vulnerability in Arista Networks EOS involving improper control of code generation (CWE-94). An unauthenticated attacker can exploit the P4Runtime feature, if enabled, to execute arbitrary code and gain full administrative control of the affected switch. P4Runtime is disabled by default. No known exploitation in the wild has been reported. The vulnerability affects multiple versions of Arista EOS from before 4.29.2F up to 4.36.1F.
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.