Arista vulnerabilities
- Arista has 138 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #90 of 420 vendors on this site by that count.
- Of the 138 with a CVSS score, 81 (58.7%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 4 vulnerabilities attributed to Arista are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2026-114625, was added on 23 Oct 2026.
- None of them is marked as known to be used in ransomware campaigns.
- For the 4 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 1 day.
Records are attributed to Arista from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 0 |
| 2020 | 0 |
| 2021 | 7 |
| 2022 | 11 |
| 2023 | 10 |
| 2024 | 7 |
| 2025 | 39 |
| 2026 | 91 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 91 | 13 | 42 | 60.4% | 0% |
| 2025 | 39 | 4 | 17 | 53.8% | 0% |
| 2024 | 7 | 0 | 5 | 71.4% | 0% |
| 2023 | 10 | 1 | 3 | 40% | 0% |
| 2022 | 11 | 3 | 3 | 54.5% | 0% |
| 2021 | 7 | 1 | 3 | 57.1% | 0% |
| 2020 | 0 | 0 | 0 | — | — |
| 2019 | 0 | 0 | 0 | — | — |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 0 | 0 | 0 | — | — |
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2026-114625 | VeloCloud Orchestrator | Arista VeloCloud Orchestrator SQL Injection Vulnerability | 2026-10-23 | Unknown |
| CVE-2026-93952 | VeloCloud Orchestrator | Arista VeloCloud Orchestrator Improper Input Validation Vulnerability | 2026-09-22 | Unknown |
| CVE-2026-16812 | VeloCloud Orchestrator | Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability | 2026-07-27 | Unknown |
| CVE-2026-7473 | Extensible Operating System | Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | 2026-06-09 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Arista records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2025-6978 | 13.4% | 96.4% | High | No |
| CVE-2026-25620 | 9.9% | 95.6% | High | No |
| CVE-2026-25622 | 9.9% | 95.6% | High | No |
| CVE-2024-27889 | 8.8% | 95.2% | High | No |
| CVE-2026-25623 | 6% | 93.2% | High | No |
| CVE-2024-27890 | 4.4% | 91.3% | High | No |
| CVE-2024-9131 | 1.4% | 72.7% | High | No |
| CVE-2021-28506 | 1.4% | 72.7% | Critical | No |
| CVE-2026-93952 | 1.4% | 72.1% | Critical | Yes |
| CVE-2026-102160 | 1.4% | 71.5% | High | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.