CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Free accounts get a daily email of the CVEs that match up to 3 of their products on My program; subscribers get each one the moment it is published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 3,357 CVEs published, 233 critical, and 2 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
3,357
Show in the list
Critical, last 7 days
233
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,762
Show in the list

Showing CVEs that name the product arista_networks:eos. Show all products

Free: a daily email for up to 3 products and the weekly digest. No card, no password. By continuing you agree to the Terms and Privacy Policy.

53 CVEs
Showing 1 to 10.
CVESeverityTitlePublished
CVE-2025-3456Low 3.8On affected platforms running Arista EOS, the global common encryption key configuration may be logged in clear text, in local or remote accounting logs. Knowledge of both the encryption key and protocol specific encrypted secrets from the device running-c
Assigned by Arista
Aug 25, 2025
CVE-2025-8870Medium 4.9On affected platforms running Arista EOS, certain serial console input might result in an unexpected reload of the device.
Assigned by Arista
Nov 14, 2025
CVE-2025-8872Medium 6.5A specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted
Assigned by Arista
Dec 16, 2025
CVE-2025-7048Medium 4.3On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption o
Assigned by Arista
Jan 6, 2026
CVE-2024-6858Medium 6.5In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.
Assigned by Arista
Jun 4, 2026
CVE-2024-27891Medium 5.3On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports.
Assigned by Arista
Jun 4, 2026
CVE-2024-27890Critical 9.6On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).
Assigned by Arista
Jun 4, 2026
CVE-2024-27892Critical 9.6On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).
Assigned by Arista
Jun 4, 2026
CVE-2023-5502Medium 5.9On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication.
Assigned by Arista
Jun 4, 2026
CVE-2025-8873High 7.5Arista EOS Dataplane Denial of Service via Malformed IPsec Packet
Assigned by Arista
Jun 4, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Essential cookies only, unless you allow a Google ads cookie. See our .