Security Advisories
Arista Networks is committed to maintaining the highest standards of security across our product portfolio. Leveraging extensive testing and monitoring of vulnerabilities to isolate and neutralize threats early, Arista's Product Security Incident Response Team (PSIRT) provides global coverage for public reporting of possible security vulnerabilities across the product portfolio.
The PSIRT team monitors industry-wide vulnerability reporting as well as providing a single point of contact for customers and interested third parties to investigate and identify potential threats. The PSIRT team also works to communicate these issues back to the user community in a timely manner.
Arista's approach to vulnerability management and links to best practice guidelines can be found here.
For technical assistance with workarounds and hotfix installations recommended in security advisories, please contact the Arista Support team at This email address is being protected from spambots. You need JavaScript enabled to view it..
Report security vulnerabilities found in Arista products to the PSIRT team via This email address is being protected from spambots. You need JavaScript enabled to view it.. It is recommended to use Arista's PGP key for secure and private communication directly with the PSIRT team.
Arista PSIRT is happy to work with researchers on discovered vulnerabilities in Arista products, the assignment of CVEs, and timelines for responsible disclosure. If a researcher discovers a new vulnerability they will be acknowledged in the advisory related to the vulnerability. Arista PSIRT is interested in receiving reports on issues affecting features in both Arista code as well as Open Source Software used in Arista products. Security issues found in Open Source Software which do not affect Arista products are out of the scope of Arista and should be referred to the appropriate CNA found here.
PSIRT Advisories
The following advisories and referenced materials are provided on an "as is" basis for use at your own risk. Arista Networks reserves the right to change or update the advisories without notice at any time.
Security Advisory 0207
November 10, 2026
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.
Security Advisory 0206
November 10, 2026
On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.
Security Advisory 0205
November 10, 2026
On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services.
Security Advisory 0204
November 3, 2026 - [updated November 10, 2026]
Recent enhancements to our vulnerability detection processes have resulted in a higher-than-usual volume of security updates. Arista is providing this advance notification to help our customers plan. To streamline remediation efforts and allow customers to address them in a consolidated maintenance window, Arista is consolidating a larger volume of discrete advisories into aggregated bulk advisory releases.
Security Advisory 0203
November 2, 2026 - [updated November 10, 2026]
Arista Networks is providing this security update in response to a vulnerability affecting the use of IPv4 in the Linux kernel. It is believed to be possible to allow an unauthenticated attacker remote code execution (RCE) in the kernel if exploited. As of the time of this publication the only known means of exploiting this vulnerability requires multipath TCP (MPTCP) to be enabled in the Linux kernel.
Security Advisory 0202
November 2, 2026
This security advisory addresses CVE-2026-111497 (HTTP2Shell), which involves a buffer overflow vulnerability within Google's Brotli C decoder and bundled software versions. A remote, unauthenticated attacker could exploit this issue by supplying a specifically crafted PDU potentially causing a denial of service, exposing sensitive memory, or executing arbitrary code.
Security Advisory 0201
October 23, 2026
This security advisory is in response to the eMudhra Intermediate CA key compromise. This issue exposes affected systems to Man in the Middle (MitM) attacks. There are multiple CVEs tracking this issue. As of the time of this publication, CVE-2026-111943 is the only CVE, applicable to components used in Arista software products. This vulnerability applies to any software that verifies an X.509 certificate using a trust store that implicitly trusts any of the compromised CA certificates.
Security Advisory 0200
October 23, 2026
Arista Networks is providing this security advisory in response to the following PHP vulnerabilities.
Security Advisory 0199
October 22, 2026
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Security Advisory 0198
October 6, 2026
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.