Security Advisories
Arista Networks is committed to maintaining the highest standards of security across our product portfolio. Leveraging extensive testing and monitoring of vulnerabilities to isolate and neutralize threats early, Arista's Product Security Incident Response Team (PSIRT) provides global coverage for public reporting of possible security vulnerabilities across the product portfolio.
The PSIRT team monitors industry-wide vulnerability reporting as well as providing a single point of contact for customers and interested third parties to investigate and identify potential threats. The PSIRT team also works to communicate these issues back to the user community in a timely manner.
Arista's approach to vulnerability management and links to best practice guidelines can be found here.
For technical assistance with workarounds and hotfix installations recommended in security advisories, please contact the Arista Support team at このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。.
Report security vulnerabilities found in Arista products to the PSIRT team via このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。. It is recommended to use Arista's PGP key for secure and private communication directly with the PSIRT team.
Arista PSIRT is happy to work with researchers on discovered vulnerabilities in Arista products, the assignment of CVEs, and timelines for responsible disclosure. If a researcher discovers a new vulnerability they will be acknowledged in the advisory related to the vulnerability. Arista PSIRT is interested in receiving reports on issues affecting features in both Arista code as well as Open Source Software used in Arista products. Security issues found in Open Source Software which do not affect Arista products are out of the scope of Arista and should be referred to the appropriate CNA found here.
PSIRT Advisories
The following advisories and referenced materials are provided on an "as is" basis for use at your own risk. Arista Networks reserves the right to change or update the advisories without notice at any time.
Security Advisory 0188
October 6, 2026
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
Security Advisory 0187
October 6, 2026
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.
Security Advisory 0186
October 6, 2026
All CVEs covered in this advisory affect platforms running CloudVision Portal (on-premises) where OpenID Connect (OIDC)-based single sign-on (SSO) is configured with an identity provider. OIDC SSO is an optional, explicitly configured authentication method. Deployments using non-OIDC SSO methods are not affected.
Security Advisory 0185
October 6, 2026
CV-CUE is Arista’s Wi-Fi management service and, in on-premises deployments, is hosted as a service on the CloudVision Portal on-premises platform. Because the affected component is used by both product deployments, customers running either CVP or CV-CUE should review the affected versions to assess their impact.
Security Advisory 0184
September 29, 2026
On October 6, 2026 Arista published multiple Security Advisories. This update serves as a summary of those security advisories. Customers are encouraged to review each advisory that may impact their environment to assess the vulnerability conditions as well as mitigation and remediation options.
Security Advisory 0183
September 22, 2026
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
Security Advisory 0182
September 9, 2026
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Security Advisory 0181
September 9, 2026
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Security Advisory 0180
September 9, 2026
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
Security Advisory 0179
September 9, 2026
On a VeloCloud Edge, an unauthenticated actor with network access to the private HA (High Availability) interconnect may trigger sensitive HA peer functions without verification.