The flaws in the first batch were found by Arista's own tooling, and each advisory will publish with a software fix and remediation guidance attached, according to Duda and Bevis [10][6]. The exposure begins when the batch does. On September 9 the CVE identifiers, severity scores and affected version lists go up together [2], which hands every reader of that page one date and a map of where to look in EOS and VeloCloud.
Three months of Arista's old rate is about six advisories [13][16]. Arista has not said how many are in the first release [14], so the multiplier is unknown until the page publishes, and so is the number of change windows a customer has to book this quarter.
The blog post's framing runs wider than its evidence. Duda and Bevis write that frontier AI can find and weaponize software flaws in minutes rather than months, and that the volume of vulnerabilities disclosed across application and infrastructure software worldwide is set to spike [11]. That is a forecast about attackers. What is documented is one supplier's discovery rate rising after AI-driven vulnerability discovery was layered onto an existing security pipeline [8], and Arista's own post is the source for the model names and the Project Glasswing partnership behind it [9]. For a shop running EOS, the near-term problem is the calendar: more advisories to triage, and maintenance windows to find in networks that were never supposed to go down, which is the constraint Duda and Bevis name themselves [15].
Arista's answer to that is its advisory subscription list and CloudVision's Compliance Dashboard once the advisories are live [7]. Batching is the part that changes a customer's process: one predictable date to argue through change control instead of a scattering of them, which Duda and Bevis say is easier to plan around and staff for [5]. The cost of the trade is concentration. Ten fixes landing on one date compete for one window, and the advance notice exists so customers can budget for that before it happens [3].
