Arista owners have two things to act on this month. The first is Arista's advisory on the eMudhra certificate authority, which reaches EOS on the switch families we sell, and now lists fixed EOS releases. The second is a dated warning: Arista has said more EOS advisories will be published on November 10, 2026. Here is what the first one says, which releases fix it, what to do before a fix is in place, and how to prepare for the second.
What Arista published
Security Advisory 0201 opens: "This security advisory is in response to the eMudhra Intermediate CA key compromise." It is dated "Date: October 23, 2026", is tracked as CVE-2026-111943, and its revision history records "Further clarifications and additional release versions provided" as fixes were added. Arista has not posted its own score yet: the CVSS field reads "Not yet available (see note below)"
The exposure is in what the switch connects out to. Arista says "Features which establish an outgoing TLS connection from the EOS switch to external servers are at risk".
Which switches
The EOS platforms Arista lists include "7170 Series 7050X3/X4 Series 7060X/X2/X4/X5/X6 Series 7260X/X3 Series 7280R/R2/R3/R4 Series", and further down "7388X5 Series 7500R/R2/R3 Series 7800R3/R4 Series". The deciding test is the software, not the box: "If your software release is not listed, your deployment is not vulnerable, regardless of the hardware platform in use." If you run an older EOS switch that is not in the platform list, check its release against the affected list below.
Affected and fixed EOS releases
| EOS train | Affected | First fixed |
|---|---|---|
| 4.37.x | none listed | 4.37.0F and later |
| 4.36.x | 4.36.3M and below | 4.36.3.2M and later |
| 4.35.x | 4.35.7M and below | 4.35.7.2M and later |
| 4.34.x | 4.34.9M and below | 4.34.9.2M and later |
| 4.33.x | 4.33.11M and below | 4.33.11.2M and later |
| 4.32.x to 4.29.x | all releases | no fix listed in the train |
| 4.28.x | 4.28.14M and below | no fix listed in the train |
| before 4.28 | all releases | no fix listed |
Arista's affected list reads, in part, "All releases in the 4.32.x train" through "All releases in the 4.29.x train", and "All releases in all trains prior to 4.28". The fixed list starts at the 4.33.x train. So a switch on 4.32 or older has no fix inside its own train: the path is a move to a fixed release in 4.33 or later, if the hardware runs it.
Before you upgrade
Arista's first line of advice: "The recommendation is to ultimately upgrade to the latest version of EOS with a fix as soon as it is available." For the gap until then, the advisory gives commands for a boot script: "The above commands in bold should be run to create a boot script that distrusts the affected CA certificates." It comes with a caution: "Employing this mitigation may result in failing TLS handshakes for connections where there is still a reliance" on those certificates. Test it on one switch first.
If your switches stream to CloudVision, there is a second piece. Arista says: "Note: the Streaming Telemetry Agent upgrade alone provides remediation for the EOS to CloudVision connection." That covers the CloudVision link only; for everything else, "a full EOS upgrade is required to provide complete remediation from this issue".
More EOS advisories on November 10
Security Advisory 0204, dated "Date: November 3, 2026", reads: "Arista is providing advance notice for multiple Security Advisories scheduled for publication on November 10, 2026." It adds: "Arista expects multiple advisories to be included in this upcoming release, affecting EOS," along with "Wi-Fi Access Point software, and software for certain DCA Appliance products." The details are not out yet.
That makes the timing simple. If you are about to schedule an EOS upgrade for the eMudhra fix, read the November 10 advisories first, so one window covers both.
Not every Arista notice this autumn touches switches. Security Advisory 0203, on a Linux kernel flaw, says "Because of the MPTCP prerequisite, few Arista product lines are affected, but the underlying issue is present in many products", and lists only the "Arista Network Detection and Response (NDR) Security Platform (Formerly Awake NDR)" as affected.
Buying Arista now
If you are buying, ask which EOS release is on the switch and plan the first boot on a fixed release. We have a 7050X3 Series switch, a 7280R Series switch, a 7060X Series switch and a 7260X Series switch in stock, with the rest on the 7050X3 and 7280R shelves and every model under Arista switches.
Check the release before the switch goes into service: the show version command prints the EOS release, and its train tells you which row of the affected and fixed table above applies. A switch already on a release Arista lists as fixed does not need the boot script.
When you ask for a quote, tell us the EOS release you plan to run. For the differences between these families, see our Arista guide.
