EOS
117 CVEs tracked. 3 of them are in CISA KEV.
This hub aggregates every CVE we track for EOS, a product in the networking infrastructure space. Use it to gauge the current risk picture and drill into individual advisories.
EOS CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 2 |
| 2025-02 | 0 |
| 2025-03 | 4 |
| 2025-04 | 0 |
| 2025-05 | 5 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 2 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 1 |
| 2025-12 | 1 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 8 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 41 |
Severity
How the 117 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical19
- High32
- Medium55
- Low11
Latest CVEs
The 15 most recently published vulnerabilities affecting EOS.
- CVE-2026-73462On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I6.5
- CVE-2026-73457Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.5.3
- CVE-2026-73456Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.10.0
- CVE-2026-73442On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for3.0
- CVE-2026-73443On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef4.7
- CVE-2026-77190Security Advisory 01776.5
- CVE-2026-73468Security Advisory 01756.5
- CVE-2026-73469Security Advisory 01765.8
- CVE-2026-73440Security Advisory 01784.2
- CVE-2026-73453Security Advisory 017410.0
- CVE-2026-73455Security Advisory 01737.5
- CVE-2026-73438Security Advisory 01725.3
- CVE-2026-73436Security Advisory 01716.5
- CVE-2026-73435Security Advisory 01718.2
- CVE-2026-19640Security Advisory 01704.2
Product grouping is registry-driven, with AI assist and human review. How it works