ZeusQA
Start free

Known exploited vulnerabilities

Arista vulnerabilities attackers have used

Every Arista vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 4 Arista vulnerabilities as exploited in the wild, 4 of them added in the last 12 months. The most recent is CVE-2026-114625, added Oct 23, 2026. VeloCloud Orchestrator has the most entries (3).

In KEV, all time
4
Added, last 12 months
4
Used in ransomware
0
New CVEs this week
0

By product

VeloCloud Orchestrator (3), Extensible Operating System (1).

Every Arista entry in CISA KEV

  1. CVE-2026-114625

    Added · due

    Arista VeloCloud Orchestrator SQL Injection Vulnerability

    Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality…

  2. CVE-2026-93952

    Added · due

    Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

    Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise…

  3. CVE-2026-16812

    Added · due

    Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

    Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the…

  4. CVE-2026-7473

    Added · due

    Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

    Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its…

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works