What’s Vulnerable › Vulnerabilities
CVE-2024-11186: On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-prem
- Severity: critical (CVSS 10.0 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.8% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-05-08 · updated 2026-06-17
- Weakness: CWE-287
Description
On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS devices than intended. This advisory impacts the Arista CloudVision Portal products when run on-premise. It does not impact CloudVision as-a-Service.
Affected products
- Arista Networks CloudVision Portal: from 2024.2.0 through 2024.2.1; from 2024.1.0 through 2024.1.2; 2024.3.0, 2023.3, 2023.2, 2023.1, 2022.3, 2022.2 (+11)
References
Get alerted when CVE-2024-11186 or the next vulnerability affects your stack