Arista Security Vulnerabilities Risk Remote Code Execution

TL;DR

Arista Networks fixed two critical bugs on November 2, 2026. These updates patch serious Arista security vulnerabilities in core networking gear. Both flaws earn high 9.8 CVSS scores and permit remote code execution. Therefore, network teams must act fast and update their systems right away.

Why It Matters

Arista gear runs in major cloud hubs and firm networks. Analysts estimate that Arista devices operate in tens of thousands of firms worldwide. In addition, large phone carriers depend on these tools every day to move web traffic safely.

Flaws in core network gear bring real risk. If intruders breach network tools, they can steal private files. They can also halt key operations. Fortunately, the vendor reports no active attacks in customer networks. Specifically, Arista stated that “the company is not aware of any malicious exploitation of this vulnerability in customer networks.” Furthermore, researchers have shared no public exploit code for either bug.

How the Attack Works

The two advisories target different software stacks and network protocols.

Google Brotli Buffer Overflow in VeloCloud

The first issue is CVE-2026-111497, also called HTTP2Shell. This bug stems from a buffer overflow in Google’s Brotli C code. The Arista VeloCloud Orchestrator bulletin warns of the risk. The advisory explains that “A remote, unauthenticated attacker could exploit this issue by supplying a specifically crafted PDU potentially causing a denial of service, exposing sensitive memory, or executing arbitrary code.”

The bug triggers when the tool reads a bad compressed file from an outside link. For example, bad actors can poison remote web endpoints to send corrupt data. Consequently, the client writes data out of bounds during file decompression. This allows an attacker to crash the host or run arbitrary code.

Linux Kernel IPv4 Use-After-Free Flaw

Meanwhile, the second bug is CVE-2026-98432. This flaw is a use-after-free bug in the Linux kernel IPv4 stack. The Arista Linux kernel advisory explains the trigger. In fact, Arista noted that “NDR devices are vulnerable by default.” The advisory also noted: “As of the time of this publication the only known means of exploiting this vulnerability requires multipath TCP (MPTCP) to be enabled in the Linux kernel.”

When systems run MPTCP, an attacker can send bad IPv4 packets. In turn, these packets corrupt kernel memory. This flaw lets hackers run code as root without a password. Attackers can take over the device completely. They can steal keys and spy on all network packets.

Affected Versions

These Arista security vulnerabilities affect specific product lines. CVE-2026-111497 affects VeloCloud Orchestrator in the 6.4.2, 6.1.3, and 5.2.3 trains. Meanwhile, CVE-2026-98432 impacts Wi-Fi Access Points in OpenConfig mode. It also affects the NDR platform on version 5.4.11 and older. However, standard EOS switches and CloudVision services remain safe.

Patch and Mitigation Steps

Arista released software patches for VeloCloud Orchestrator. The vendor warned: “There is no mitigation available for this issue.” Thus, customers should upgrade to version 6.4.2.14, 6.1.3.12, or 5.2.3.20. For NDR devices, teams are turning off MPTCP right now. Air-gapped sites must contact support for manual fixes. Finally, access point admins must restrict open ports to trusted networks.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.