# Arista Networks vulnerabilities & exploitation **CISA KEV** > As of 2026-10-05, Threadlinqs tracks 6 Arista Networks CVEs, 2 in the CISA Known Exploited Vulnerabilities catalog, linked to 5 tracked threat campaigns. **Data as of:** 2026-10-05 ## Exploitation timeline Threadlinqs has recorded 6 Arista Networks CVEs published between 2026-07-15 and 2026-09-15. The busiest month was 2026-09 (5 new CVEs). 2 of them (33%) are listed in CISA KEV, which means exploitation in the wild has been confirmed. ## Most exploited vulnerabilities Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked Arista Networks CVEs. - [CVE-2026-93952](https://intel.threadlinqs.com/cve/CVE-2026-93952) — CRITICAL 10 · KEV · EPSS 1.1% · 2026-09-22 - [CVE-2026-16812](https://intel.threadlinqs.com/cve/CVE-2026-16812) — CRITICAL 10 · KEV · EPSS 0.9% · 2026-07-27 - [CVE-2026-75944](https://intel.threadlinqs.com/cve/CVE-2026-75944) — LOW 2.6 · EPSS 0.1% · 2026-09-14 - [CVE-2026-77191](https://intel.threadlinqs.com/cve/CVE-2026-77191) — LOW 2.6 · EPSS 0.1% · 2026-09-14 - [CVE-2026-75943](https://intel.threadlinqs.com/cve/CVE-2026-75943) — LOW 2.6 · EPSS 0.1% · 2026-09-14 - [CVE-2026-75945](https://intel.threadlinqs.com/cve/CVE-2026-75945) — LOW 2.6 · EPSS 0.1% · 2026-09-14 ## Products affected Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 3 distinct Arista Networks products are affected. The most frequently affected: - EOS — 4 CVEs - VeloCloud Orchestrator (VCO) On-Prem — 1 CVE - VeloCloud Orchestrator On-Prem — 1 CVE ## Threat activity 5 tracked threat campaigns reference Arista Networks products or exploit Arista Networks CVEs: - [CISA Adds Four Actively Exploited KEVs: Check Point Gateway/Management RCE Flaws, Arista VeloCloud Orchestrator Auth Bypass, F5 BIG-IP APM Heap Overflow](https://intel.threadlinqs.com/threat/TL-2026-2678) — CRITICAL — 2026-09-26 - [CVE-2026-16812 — Critical Unauthenticated OS Command Injection in Arista VeloCloud Orchestrator Actively Exploited](https://intel.threadlinqs.com/threat/TL-2026-1851) — CRITICAL — 2026-08-03 - [CISA Adds Two Known Exploited Vulnerabilities to Catalog: Fortinet FortiOS Information Disclosure (CVE-2025-68686) and Arista VeloCloud Orchestrator OS Command Injection (CVE-2026-16812)](https://intel.threadlinqs.com/threat/TL-2026-1725) — CRITICAL — 2026-07-27 - [CVE-2025-6978: Authenticated Diagnostics Command Injection Leading to Root RCE in Arista NG Firewall](https://intel.threadlinqs.com/threat/TL-2026-1550) — HIGH — 2026-07-19 - [CVE-2026-7473: Arista EOS Tunnel Decapsulation Protocol-Confusion Bypass — No Vendor Patch, Actively Exploited](https://intel.threadlinqs.com/threat/TL-2026-1493) — CRITICAL — 2026-06-16 ## How to prioritise Arista Networks patching This order follows the data Threadlinqs holds for Arista Networks, not a generic severity checklist: - 2 of 6 Arista Networks CVEs (33%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with [CVE-2026-93952](https://intel.threadlinqs.com/cve/CVE-2026-93952), [CVE-2026-16812](https://intel.threadlinqs.com/cve/CVE-2026-16812). - Outside KEV, the highest EPSS scores are [CVE-2026-75944](https://intel.threadlinqs.com/cve/CVE-2026-75944) (0.1%), [CVE-2026-77191](https://intel.threadlinqs.com/cve/CVE-2026-77191) (0.1%), [CVE-2026-75943](https://intel.threadlinqs.com/cve/CVE-2026-75943) (0.1%). - 2 CVEs score Critical and 0 High on CVSS v3 (maximum 10, average 5.1); sequence these after KEV and high-EPSS items. ## About this data Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-05 and refresh daily. Canonical: https://intel.threadlinqs.com/vendors/arista-networks All vendors: https://intel.threadlinqs.com/vendors Full detection coverage and IOCs via the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp