Arista Networks
US data-centre networking vendor; maker of the EOS switch operating system.
Arista Networks is a US data-centre networking vendor whose VeloCloud Orchestrator carried CVE-2026-16812, added to CISA's KEV catalogue on 27 July 2026 with a 30 July deadline.
Last refreshed: 3 August 2026 · Appears in 1 active topic
Timeline for Arista Networks
Mentioned in: KEV patch clocks fell to three days
Cybersecurity: Threats and DefencesArista, Fortinet and Cisco flaws listed
Cybersecurity: Threats and DefencesCISA tears up its KEV deadline rules
Cybersecurity: Threats and DefencesMentioned in: Arista refuses to patch KEV flaw
Cybersecurity: Threats and DefencesBackground
Arista Networks is a US data-centre networking vendor best known for its EOS switch operating system, widely deployed in large enterprise and cloud data centres. Arista expanded into software-defined wide-area networking through its acquisition of VeloCloud from Broadcom, which is why VeloCloud Orchestrator now appears under Arista's name in vulnerability catalogues rather than as a standalone product.
Arista EOS, the switch operating system, is tracked as a separate entity and should not be conflated with the parent company or with VeloCloud.
Arista's core customer base sits in large-scale cloud and enterprise data centres, where EOS competes with offerings from vendors such as Cisco and Juniper. The VeloCloud acquisition extended that footprint into software-defined wide-area networking, broadening Arista's exposure to a different class of deployment and a different vulnerability surface than its traditional switch business.
Arista drew a three-day patch order
CISA added CVE-2026-16812, a command injection in VeloCloud Orchestrator, to its KEV catalogue on 27 July 2026 with a 30 July deadline, one of three flaws listed in that batch alongside entries from Fortinet and Cisco. VeloCloud Orchestrator sits in Arista's portfolio because Arista acquired VeloCloud from Broadcom; the catalogue entry reflects that ownership rather than a flaw in Arista's own EOS switch line.
The three-day window follows the pattern set on 10 June 2026, when CISA tore up its fixed 14-day default under BOD 26-04 for a four-tier model assigning 3-day, 14-day, 60-day or next-cycle deadlines depending on assessed danger.
Who owns VeloCloud Orchestrator?
Why was Arista Networks added to CISA's known exploited vulnerabilities catalogue?
What does Arista Networks make?
Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 3 August 2026. Editorial standards.