Arista Networks published advisories for two remote code execution flaws, both scored CVSS 9.8: CVE-2026-111497, nicknamed HTTP2Shell, in VeloCloud Orchestrator, and CVE-2026-98432, a Linux kernel bug affecting Wi-Fi access points and NDR devices. Arista said it is not aware of malicious exploitation in customer networks, and no public exploit code exists.
HTTP2Shell: Brotli Buffer Overflow in VeloCloud Orchestrator
CVE-2026-111497 is a buffer overflow in Google’s Brotli C code inside VeloCloud Orchestrator. A remote unauthenticated attacker who supplies a crafted protocol data unit could cause denial of service, expose memory or execute code. The flaw can trigger when the tool reads bad compressed data from an outside link.
It affects the 6.4.2, 6.1.3 and 5.2.3 release trains. Fixed versions are 6.4.2.14, 6.1.3.12 and 5.2.3.20. Arista’s advisory states: “There is no mitigation available,” so upgrading is the only remedy.
HTTP2Shell Exposes VeloCloud Orchestrator Keys and Traffic
VeloCloud Orchestrator manages network deployments, so a compromise can expose keys and traffic across the infrastructure it controls. Arista’s description makes clear that the attack needs no credentials, only the ability to feed the tool malformed compressed data.
CVE-2026-98432: Kernel Use-After-Free Race Reaches Root
CVE-2026-98432 is a use-after-free race condition in the Linux kernel’s IPv4 TCP code that can lead to root code execution. Arista says the only known exploit path requires Multipath TCP (MPTCP) to be enabled.
The flaw affects Wi-Fi Access Points in OpenConfig mode and NDR devices on version 5.4.11 and older. Arista notes that NDR devices are vulnerable by default. Standard EOS switches and CloudVision are not affected.
Arista Mitigations: Disable MPTCP on NDR, Restrict AP Ports
Arista’s mitigations are to disable MPTCP on NDR and to restrict open ports on access points. Air-gapped sites must contact Arista support for guidance.
Ubuntu Fixes Land in the Proposed Pocket
Separate reporting on Tuesday said Canonical placed kernel fixes for CVE-2026-98432 in the Ubuntu -proposed pocket for 22.04 LTS and newer. Every kernel since version 4.4 carries the bug. It was reported by Xinyang Ge, a researcher at Anthropic, and Canonical said the unreleased exploit generated by Anthropic uses MPTCP.
That detail matches Arista’s finding that MPTCP is the only known path. It also means that the exposure extends well beyond Arista, to any Linux system running an affected kernel with the option enabled.
Linux Kernel 4.4 Onward Carries CVE-2026-98432
A bug present in every kernel since 4.4 spans most Linux deployments in existence, from servers to embedded network gear. The limiting factor for attackers is the MPTCP requirement, which narrows practical exploitation to systems that have turned the feature on or ship with it enabled, as Arista’s NDR devices do.
Arista Inherits Brotli and Linux Kernel Flaws From Upstream
Both advisories show how vulnerabilities in widely shared open-source components pass into commercial network products. The Brotli overflow originates in Google’s compression code, and the kernel bug lives in code used across Linux distributions. In each case the vendor must track upstream flaws, rebuild its software and ship fixes to customers, and the customers must then schedule upgrades on infrastructure that is often hard to take offline.
The no-mitigation status of HTTP2Shell leaves administrators of VeloCloud Orchestrator without an interim control, which raises the importance of the upgrade windows. For CVE-2026-98432, the dependence on an optional kernel feature offers a configuration-based defense, but Arista notes NDR devices run with it by default, so the default posture is the exposed one. Arista reports no customer exploitation, and the two advisories give the first public notice of the flaws.
Arista Reports No Exploitation of Either Flaw
Arista said it is not aware of malicious exploitation in customer networks and that no public exploit code exists. The advisory does not give a count of affected deployments. The company’s guidance for air-gapped sites, which must contact support, reflects that those environments cannot easily pull fixes or run the standard update path, and so need individual handling.
