Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
135 vulnerabilities
CVE-2026-73462 (GCVE-0-2026-73462)
Vulnerability from cvelistv5 – Published: 2026-09-16 19:01 – Updated: 2026-09-17 18:31
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I
Summary
On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:31 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.8M (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:31:00.764860Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:31:19.459Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.9M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIGMP snooping agent is instantiated by default on EOS. No configuration is required.\u003c/p\u003e"
}
],
"value": "IGMP snooping agent is instantiated by default on EOS. No configuration is required."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Over-read Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:01:21.043Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24715-security-advisory-0159"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73462 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73462 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.9M and later releases in the 4.33.x train"
}
],
"source": {
"advisory": "159",
"defect": [
"BUG1570495",
"BUG1571339"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available. Disabling IGMP snooping will NOT mitigate the issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available. Disabling IGMP snooping will NOT mitigate the issue."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73462",
"datePublished": "2026-09-16T19:01:21.043Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-17T18:31:19.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73457 (GCVE-0-2026-73457)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:57 – Updated: 2026-09-17 18:32
VLAI
EPSS
VEX
Title
Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.
Summary
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:32 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.2F , ≤ 4.34.7M (custom) |
Date Public
2026-09-09 18:55
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73457",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:32:07.235252Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:32:20.363Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73457, gNPSI must be configured with trace facility EosRpcAuth enabled explicitly:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt; show trace Gnpsi | grep Auth\nEosRpcAuth enabled 0123456789.\u003c/pre\u003e\u003cp\u003eSystems remain unaffected if gNPSI is not enabled (default configuration):\u003c/p\u003e\u003cpre\u003eswitch\u0026gt; show management api gnpsi\nEnabled: no transports enabled\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73457, gNPSI must be configured with trace facility EosRpcAuth enabled explicitly:\n\n\n\nswitch\u003e show trace Gnpsi | grep Auth\nEosRpcAuth enabled 0123456789.\n\n\n\nSystems remain unaffected if gNPSI is not enabled (default configuration):\n\n\n\nswitch\u003e show management api gnpsi\nEnabled: no transports enabled"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T18:55:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnder certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.\u003c/p\u003e"
}
],
"value": "Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 Information Disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:57:50.711Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73457 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73457 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train"
}
],
"source": {
"advisory": "158",
"defect": [
"1824885"
],
"discovery": "INTERNAL"
},
"title": "Under certain circumstances, the gNPSI client credentials might be logged in clear text, in local or remote accounting logs to authenticated users.",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo secure the agent against\u0026nbsp; CVE-2026-73457, the service must be configured to use \u003ci\u003emutual TLS\u003c/i\u003e and only\u003ci\u003e x509-spiffe \u003c/i\u003eauthentication must be enabled.\u003c/p\u003e\u003cpre\u003emanagement security\n\u0026nbsp;\u0026nbsp;\u0026nbsp;ssl profile P1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;certificate server.crt key server.key\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;trust certificate ca_client.crt\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n\u0026nbsp;\u0026nbsp;\u0026nbsp;transport grpc t2\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;ssl profile P1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;port 7001\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;authentication username priority x509-spiffe\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;no disabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eLogs are disabled by default, including the affected facility \u003cb\u003eEosRpcAuth\u003c/b\u003e.To mitigate CVE-2026-73457, ensure the facility \u003cb\u003eEosRpcAuth\u003c/b\u003e status is set to disabled. The command below can be used to restore all Gnpsi agent tracing to its default setting.\u003c/p\u003e\u003cpre\u003eswitch(config)# no trace Gnpsi setting\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent gNPSI client credentials leaking.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up Gnpsi log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/Gnpsi*\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027Gnpsi*.gz\u0027 -type f -delete\u003c/pre\u003e"
}
],
"value": "To secure the agent against\u00a0 CVE-2026-73457, the service must be configured to use mutual TLS and only x509-spiffe authentication must be enabled.\n\n\n\nmanagement security\n\u00a0\u00a0\u00a0ssl profile P1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0certificate server.crt key server.key\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0trust certificate ca_client.crt\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n\u00a0\u00a0\u00a0transport grpc t2\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0ssl profile P1\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0port 7001\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0authentication username priority x509-spiffe\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0no disabled\n\n\n\u00a0\n\n\n\nLogs are disabled by default, including the affected facility EosRpcAuth.To mitigate CVE-2026-73457, ensure the facility EosRpcAuth status is set to disabled. The command below can be used to restore all Gnpsi agent tracing to its default setting.\n\n\n\nswitch(config)# no trace Gnpsi setting\n\n\n\u00a0\n\n\n\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent gNPSI client credentials leaking.\n\n\n\nUse the following commands to clean up Gnpsi log files:\n\n\n\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Gnpsi*\n\n\n\u00a0\n\n\n\nThen use the following commands to clean up previously rotated old log files:\n\n\n\nswitch(config)# bash sudo find /var/log/agents -name \u0027Gnpsi*.gz\u0027 -type f -delete"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73457",
"datePublished": "2026-09-16T18:57:50.711Z",
"dateReserved": "2026-08-12T16:45:03.510Z",
"dateUpdated": "2026-09-17T18:32:20.363Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73456 (GCVE-0-2026-73456)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:54 – Updated: 2026-09-17 11:39
VLAI
EPSS
VEX
Title
Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
Summary
Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 03:57 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.2F , ≤ 4.34.7M (custom) |
Date Public
2026-09-09 18:52
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73456",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T03:57:34.132493Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T11:39:23.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73456, gNPSI must be enabled and one of the following conditions must be met:\u003c/p\u003e\u003cp\u003e1. A gNPSI transport is configured to perform TLS (server verification) and metadata authentication is enabled:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt; show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, TLS configured\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\u003c/pre\u003e\u003cp\u003e2. Or mTLS is enabled with x509-common-name authentication configured:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt; show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, mutual TLS configured\nAuthentication username priority: x509-spiffe, x509-common-name\u003c/pre\u003e\u003cp\u003eSystems remain unaffected if gNPSI is not enabled (default configuration):\u003c/p\u003e\u003cpre\u003eswitch\u0026gt; show management api gnpsi\nEnabled: no transports enabled\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73456, gNPSI must be enabled and one of the following conditions must be met:\n\n\n\n1. A gNPSI transport is configured to perform TLS (server verification) and metadata authentication is enabled:\n\n\n\nswitch\u003e show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, TLS configured\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\n\n\n2. Or mTLS is enabled with x509-common-name authentication configured:\n\n\n\nswitch\u003e show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, mutual TLS configured\nAuthentication username priority: x509-spiffe, x509-common-name\n\n\n\nSystems remain unaffected if gNPSI is not enabled (default configuration):\n\n\n\nswitch\u003e show management api gnpsi\nEnabled: no transports enabled"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T18:52:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUnder certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.\u003c/p\u003e"
}
],
"value": "Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:54:59.526Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73456 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73456 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train"
}
],
"source": {
"advisory": "158",
"defect": [
"1823956"
],
"discovery": "INTERNAL"
},
"title": "Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo secure the agent against CVE-2026-73456, configure the service to use mutual TLS and enable only x509-spiffe authentication:\u003c/p\u003e\u003cpre\u003emanagement security\n ssl profile P1\n certificate server.crt key server.key\n trust certificate ca_client.crt\n chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n transport grpc t2\n ssl profile P1\n port 7001\n authentication username priority x509-spiffe\n no disabled\u003c/pre\u003e"
}
],
"value": "To secure the agent against CVE-2026-73456, configure the service to use mutual TLS and enable only x509-spiffe authentication:\n\n\n\nmanagement security\n ssl profile P1\n certificate server.crt key server.key\n trust certificate ca_client.crt\n chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n transport grpc t2\n ssl profile P1\n port 7001\n authentication username priority x509-spiffe\n no disabled"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73456",
"datePublished": "2026-09-16T18:54:59.526Z",
"dateReserved": "2026-08-12T16:45:03.510Z",
"dateUpdated": "2026-09-17T11:39:23.874Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73442 (GCVE-0-2026-73442)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:50 – Updated: 2026-09-17 18:32
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for
Summary
On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:32 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) |
Date Public
2026-09-09 18:48
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73442",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:32:32.827325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:32:55.263Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73442, VRRP must be configured with either version 2 or version 3:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 \u0026lt;ipAddr\u0026gt;\u003c/pre\u003e\u003cp\u003eIf VRRP is not configured, there is no exposure to CVE-2026-73442.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73442, VRRP must be configured with either version 2 or version 3:\n\n\n\nswitch\u003eshow running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 \u003cipAddr\u003e\n\n\n\nIf VRRP is not configured, there is no exposure to CVE-2026-73442."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista."
}
],
"datePublic": "2026-09-09T18:48:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running."
}
],
"impacts": [
{
"capecId": "CAPEC-118",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-118 Information Disclosure"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:50:06.448Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73442 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73442 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train"
}
],
"source": {
"advisory": "157",
"defect": [
"1857627"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf the VRRP feature is not operationally required, disabling it removes the exposure. Otherwise, there is no mitigation or workaround available. Please note that disabling VRRP can lead to network outages if the primary router fails.\u003c/p\u003e"
}
],
"value": "If the VRRP feature is not operationally required, disabling it removes the exposure. Otherwise, there is no mitigation or workaround available. Please note that disabling VRRP can lead to network outages if the primary router fails."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73442",
"datePublished": "2026-09-16T18:50:06.448Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-17T18:32:55.263Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73443 (GCVE-0-2026-73443)
Vulnerability from cvelistv5 – Published: 2026-09-16 18:47 – Updated: 2026-09-17 18:33
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef
Summary
On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.
Severity
4.7 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 18:33 UTC
CWE
- CWE-294 - Authentication Bypass by Capture-replay
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) |
Date Public
2026-09-09 18:44
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73443",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T18:33:08.446292Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T18:33:52.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange",
"virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.36.2F",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.35.6M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.34.8M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"changes": [
{
"at": "4.33.10M",
"status": "unaffected"
}
],
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73443, VRRPv2 must be configured with IP-AH authentication on at least one interface:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 version 2\n vrrp 1 peer authentication ietf-md5 key-string 7 \u0026lt;key\u0026gt;\u003c/pre\u003e\u003cp\u003eIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73443, VRRPv2 must be configured with IP-AH authentication on at least one interface:\n\n\n\nswitch\u003eshow running-config section vrrp\ninterface Ethernet1\n vrrp 1 ipv4 version 2\n vrrp 1 peer authentication ietf-md5 key-string 7 \u003ckey\u003e\n\n\n\nIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure."
}
],
"datePublic": "2026-09-09T18:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address."
}
],
"impacts": [
{
"capecId": "CAPEC-60",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-60 Replay Attacks"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-294",
"description": "CWE-294 Authentication Bypass by Capture-replay",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:47:30.801Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience.\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eImportant:\u003c/strong\u003e Upgrading alone is not sufficient. The replay protection introduced by the fix is disabled by default and must be explicitly enabled with the following new global configuration command after upgrading to a remediated release:\u003c/p\u003e\u003cpre\u003eswitch(config)#vrrp ipv4 authentication anti-replay\u003c/pre\u003e\u003cp\u003eCVE-2026-73443 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience.\n\n\n\nImportant: Upgrading alone is not sufficient. The replay protection introduced by the fix is disabled by default and must be explicitly enabled with the following new global configuration command after upgrading to a remediated release:\n\n\n\nswitch(config)#vrrp ipv4 authentication anti-replay\n\n\n\nCVE-2026-73443 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train\n * 4.33.10M and later releases in the 4.33.x train"
}
],
"source": {
"advisory": "157",
"defect": [
"1866651"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExposure is limited to attackers with access to the layer 2 network segment on which VRRP is running. Restricting physical and logical access to VRRP-enabled segments (for example with port security and by not extending VRRP VLANs to untrusted access ports) reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path.\u003c/p\u003e\u003cp\u003eThe below configuration shows how to configure VRRPv3 on VLAN 20:\u003c/p\u003e\u003cpre\u003eswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3\u003c/pre\u003e"
}
],
"value": "Exposure is limited to attackers with access to the layer 2 network segment on which VRRP is running. Restricting physical and logical access to VRRP-enabled segments (for example with port security and by not extending VRRP VLANs to untrusted access ports) reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path.\n\n\n\nThe below configuration shows how to configure VRRPv3 on VLAN 20:\n\n\n\nswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73443",
"datePublished": "2026-09-16T18:47:30.801Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-17T18:33:52.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86107 (GCVE-0-2026-86107)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:49 – Updated: 2026-09-16 17:45
VLAI
EPSS
VEX
Title
Security Advisory 0180
Summary
The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.
A successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:44 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud |
Affected:
1.0.0.0 , < 5.2.0.0
(custom)
Affected: 5.2.0.0 , < 5.2.7.0 (custom) Affected: 6.1.0.0 , < 6.1.5.0 (custom) Affected: 6.4.0.0 , < 6.4.2.0 (custom) |
|
| Arista Networks | VeloCloud Gateway |
Affected:
1.0.0.0 , < 5.2.0.0
(custom)
Affected: 5.2.0.0 , < 5.2.7.0 (custom) Affected: 6.1.0.0 , < 6.1.5.0 (custom) Affected: 6.4.0.0 , < 6.4.2.0 (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86107",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:44:08.375443Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:45:20.522Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Edge",
"VeloCloud Gateway"
],
"product": "VeloCloud",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.0.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.7.0",
"status": "affected",
"version": "5.2.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.5.0",
"status": "affected",
"version": "6.1.0.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Gateway"
],
"product": "VeloCloud Gateway",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.0.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.7.0",
"status": "affected",
"version": "5.2.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.5.0",
"status": "affected",
"version": "6.1.0.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability requires an authenticated VCMP tunnel to be established between a target VeloCloud Edge or Gateway and a malicious peer.\u003c/p\u003e"
}
],
"value": "The vulnerability requires an authenticated VCMP tunnel to be established between a target VeloCloud Edge or Gateway and a malicious peer."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.\u003c/p\u003e\n\u003cp\u003eA successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic.\u003c/p\u003e"
}
],
"value": "The VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This vulnerability impacts the VeloCloud VCMP tunnel protocol only.\n\nA successful exploit can cause the affected process to terminate and restart, leading to a temporary disruption of traffic. Hosts on the internet that are unauthenticated and unable to form an overlay peer relationship can not trigger the vulnerable logic."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:49:31.522Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24736-security-advisory-0180"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e5.2.7.0 and later in the 5.2.x train\u003c/li\u003e\n\u003cli\u003e6.1.5.0 and later in the 6.1.x train\u003c/li\u003e\n\u003cli\u003e6.4.2.0 and later in the 6.4.x train\u003c/li\u003e\n\u003cli\u003e7.0.0 and later\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The following releases contain the fix:\n- 5.2.7.0 and later in the 5.2.x train\n- 6.1.5.0 and later in the 6.1.x train\n- 6.4.2.0 and later in the 6.4.x train\n- 7.0.0 and later\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0180",
"defects": [
"BUG1833888"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0180",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation is available for this issue. Customers should restrict overlay peer relationships to trusted devices and monitor for unexpected fragmentation behavior.\u003c/p\u003e"
}
],
"value": "No mitigation is available for this issue. Customers should restrict overlay peer relationships to trusted devices and monitor for unexpected fragmentation behavior."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86107",
"datePublished": "2026-09-16T10:49:31.522Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-16T17:45:20.522Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86106 (GCVE-0-2026-86106)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:12 – Updated: 2026-09-16 17:53
VLAI
EPSS
VEX
Title
Security Advisory 0179
Summary
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
Severity
9.6 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:52 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
1.0.0.0 , < 5.2.0.0
(custom)
Affected: 5.2.0.0 , < 5.2.7.0 (custom) Affected: 6.1.0.0 , < 6.1.5.0 (custom) Affected: 6.4.0.0 , < 6.4.2.0 (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86106",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:52:49.256029Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:53:47.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"VeloCloud Edge"
],
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "5.2.0.0",
"status": "affected",
"version": "1.0.0.0",
"versionType": "custom"
},
{
"lessThan": "5.2.7.0",
"status": "affected",
"version": "5.2.0.0",
"versionType": "custom"
},
{
"lessThan": "6.1.5.0",
"status": "affected",
"version": "6.1.0.0",
"versionType": "custom"
},
{
"lessThan": "6.4.2.0",
"status": "affected",
"version": "6.4.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect.\u003c/p\u003e"
}
],
"value": "The vulnerability requires HA to be enabled and the attacker to have Layer 2 network access to the dedicated HA interconnect."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.\u003c/p\u003e"
}
],
"value": "An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:25:43.381Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24735-security-advisory-0179"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following VeloCloud Edge releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e5.2.7.0 and later in the 5.2.x train\u003c/li\u003e\n\u003cli\u003e6.1.5.0 and later in the 6.1.x train\u003c/li\u003e\n\u003cli\u003e6.4.2 and later in the 6.4.x train\u003c/li\u003e\n\u003cli\u003e7.0.0 and later\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNo hotfixes are available for this issue.\u003c/p\u003e"
}
],
"value": "The following VeloCloud Edge releases contain the fix:\n- 5.2.7.0 and later in the 5.2.x train\n- 6.1.5.0 and later in the 6.1.x train\n- 6.4.2 and later in the 6.4.x train\n- 7.0.0 and later\n\nNo hotfixes are available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0179",
"defects": [
"BUG1833882"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0179",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUse dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces.\u003c/p\u003e"
}
],
"value": "Use dedicated port-to-port connections between HA pairs. Avoid extending the HA interconnect through shared switches or VLANs. Restrict physical and network access to HA interfaces."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86106",
"datePublished": "2026-09-16T10:12:55.587Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-16T17:53:47.977Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-77190 (GCVE-0-2026-77190)
Vulnerability from cvelistv5 – Published: 2026-09-16 10:08 – Updated: 2026-09-16 13:26
VLAI
EPSS
VEX
Title
Security Advisory 0177
Summary
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:26 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.2F , ≤ 4.34.7M (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-77190",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:26:18.181290Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:26:25.980Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"cEOS-lab",
"vEOS-lab"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-77190, the following conditions must both be met:\u003c/p\u003e\u003cp\u003e1. PIM Sparse Mode must be configured (IPv4 or IPv6). For example:\u003c/p\u003e\u003cpre\u003eswitch(config)# interface Ethernet1\nswitch(config-if-Et1)# pim ipv4 sparse-mode\n\nswitch# show agent Pimsm uptime\n Agent Name Restarts Uptime\n------------------ -------------- ----------------\nPimsm 1 2 days, 14:00:28\u003c/pre\u003e\u003cp\u003eor\u003c/p\u003e\u003cpre\u003eswitch(config)# interface Vlan2\nswitch(config-if-Vl2)# pim ipv6 sparse-mode\n\nswitch# show agent Pimsm6 uptime\n Agent Name Restarts Uptime\n------------------ -------------- ----------------\nPimsm6 3 2 days, 14:00:20\u003c/pre\u003e\u003cp\u003e2. MLAG must be configured and active:\u003c/p\u003e\u003cpre\u003eswitch(config)# mlag\nswitch(config-mlag)# local-interface vlan 4094\nswitch(config-mlag)# peer-address 10.0.0.2\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlag1\n\nswitch# show mlag\nMLAG Configuration:\ndomain-id : mlag1\nlocal-interface : Vlan4094\npeer-address : 10.0.0.2\npeer-link : Port-Channel10\nMLAG Status:\nstate : Active\npeer-link status : Up\nlocal-int status : Up\nsystem-id : 00:11:22:01:03:01\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-77190, the following conditions must both be met:\n\n1. PIM Sparse Mode must be configured (IPv4 or IPv6). For example:\n\n switch(config)# interface Ethernet1\n switch(config-if-Et1)# pim ipv4 sparse-mode\n\n switch# show agent Pimsm uptime\n Agent Name Restarts Uptime\n ------------------ -------------- ----------------\n Pimsm 1 2 days, 14:00:28\n\nor\n\n switch(config)# interface Vlan2\n switch(config-if-Vl2)# pim ipv6 sparse-mode\n\n switch# show agent Pimsm6 uptime\n Agent Name Restarts Uptime\n ------------------ -------------- ----------------\n Pimsm6 3 2 days, 14:00:20\n\n2. MLAG must be configured and active:\n\n switch(config)# mlag\n switch(config-mlag)# local-interface vlan 4094\n switch(config-mlag)# peer-address 10.0.0.2\n switch(config-mlag)# peer-link port-channel 10\n switch(config-mlag)# domain-id mlag1\n\n switch# show mlag\n MLAG Configuration:\n domain-id : mlag1\n local-interface : Vlan4094\n peer-address : 10.0.0.2\n peer-link : Port-Channel10\n MLAG Status:\n state : Active\n peer-link status : Up\n local-int status : Up\n system-id : 00:11:22:01:03:01"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:08:55.181Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0177",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24733-security-advisory-0177"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-77190 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-77190 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0177",
"defects": [
"BUG 1852734"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0177",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-77190",
"datePublished": "2026-09-16T10:08:55.181Z",
"dateReserved": "2026-08-20T16:41:21.387Z",
"dateUpdated": "2026-09-16T13:26:25.980Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73468 (GCVE-0-2026-73468)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:55 – Updated: 2026-09-16 13:37
VLAI
EPSS
VEX
Title
Security Advisory 0175
Summary
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:36 UTC
CWE
- CWE-670 - Always-Incorrect Control Flow Implementation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7.1M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73468",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:36:14.973508Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:37:56.689Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is exploitable on interfaces with PIM Sparse Mode configured:\u003c/p\u003e\n\u003cpre\u003e\nswitch(config)# interface Ethernet1\nswitch(config-if-Et1)# pim ipv4 sparse-mode\n\u003c/pre\u003e"
}
],
"value": "The vulnerability is exploitable on interfaces with PIM Sparse Mode configured:\n\nswitch(config)# interface Ethernet1\nswitch(config-if-Et1)# pim ipv4 sparse-mode"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.\u003c/p\u003e"
}
],
"value": "A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period."
}
],
"impacts": [
{
"capecId": "CAPEC-272",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-272 Protocol Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-670",
"description": "CWE-670 Always-Incorrect Control Flow Implementation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:55:17.069Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24731-security-advisory-0175"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e4.33.9M and later in the 4.33.x train\u003c/li\u003e\n\u003cli\u003e4.34.8M and later in the 4.34.x train\u003c/li\u003e\n\u003cli\u003e4.35.6M and later in the 4.35.x train\u003c/li\u003e\n\u003cli\u003e4.36.2F and later in the 4.36.x train\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eNo hotfixes are available for this issue.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix:\n- 4.33.9M and later in the 4.33.x train\n- 4.34.8M and later in the 4.34.x train\n- 4.35.6M and later in the 4.35.x train\n- 4.36.2F and later in the 4.36.x train\n\nNo hotfixes are available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0175",
"defects": [
"BUG1857585"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0175",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation available to address this vulnerability.\u003c/p\u003e"
}
],
"value": "There is no mitigation available to address this vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73468",
"datePublished": "2026-09-16T09:55:17.069Z",
"dateReserved": "2026-08-12T16:47:18.121Z",
"dateUpdated": "2026-09-16T13:37:56.689Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73440 (GCVE-0-2026-73440)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:55 – Updated: 2026-09-16 13:40
VLAI
EPSS
VEX
Title
Security Advisory 0178
Summary
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:40 UTC
CWE
- CWE-212 - Improper Removal of Sensitive Information Before Storage or Transfer
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7.1M (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73440",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:40:14.055400Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:40:25.872Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7150 Series",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73440, the following conditions must all be met:\u003c/p\u003e\u003cul\u003e\u003cli\u003eSNMPv3 must be configured with at least one local or remote user that has an authentication key.\u003c/li\u003e\u003cli\u003eThe SNMPv3 user CLI configuration uses the legacy syntax and does not include the updated \u0026quot;key \u0026lt;algo\u0026gt; \u0026lt;encrypted_text\u0026gt;\u0026quot; syntax.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor example:\u003c/p\u003e\u003cpre\u003eswitch# show running-config | section snmp-server\nsnmp-server user alice group_alice v3 localized f5717f2cdde9bb946d00 auth sha256 f4b9ec9a299a10a5dec3541f44f44000484254ee56fa404236730520e10ce689\u003c/pre\u003e\u003cp\u003eTo verify whether any SNMPv3 users with authentication are configured:\u003c/p\u003e\u003cpre\u003eswitch# show snmp user\n\nUser name : alice\nSecurity model : v3\nEngine ID : f5717f2cdde9bb946d00\nAuthentication : SHA-256\nPrivacy : None\nGroup : group_alice\u003c/pre\u003e\u003cp\u003eIf SNMP is not configured or no SNMPv3 users are configured, there is no exposure to this issue:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow snmp\nChassis: XXXXXXXXXXX\nSNMP agent enabled in VRFs: default\nTransmit message maximum size: 65536\nSNMP agent disabled: Either no communities and no users are configured, or no VRFs are configured.\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73440, the following conditions must all be met:\n\n- SNMPv3 must be configured with at least one local or remote user that has an authentication key.\n- The SNMPv3 user CLI configuration uses the legacy syntax and does not include the updated \"key \u003calgo\u003e \u003cencrypted_text\u003e\" syntax.\n\nFor example:\n\n switch# show running-config | section snmp-server\n snmp-server user alice group_alice v3 localized f5717f2cdde9bb946d00 auth sha256 f4b9ec9a299a10a5dec3541f44f44000484254ee56fa404236730520e10ce689\n\nTo verify whether any SNMPv3 users with authentication are configured:\n\n switch# show snmp user\n\n User name : alice\n Security model : v3\n Engine ID : f5717f2cdde9bb946d00\n Authentication : SHA-256\n Privacy : None\n Group : group_alice\n\nIf SNMP is not configured or no SNMPv3 users are configured, there is no exposure to this issue:\n\n switch\u003eshow snmp\n Chassis: XXXXXXXXXXX\n SNMP agent enabled in VRFs: default\n Transmit message maximum size: 65536\n SNMP agent disabled: Either no communities and no users are configured, or no VRFs are configured."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device\u0027s running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device\u0027s running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-212",
"description": "CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:41.299Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0178",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eFollowing the system upgrade, users are required to execute the syntax conversion command specified below to adopt the updated, encrypted SNMPv3 CLI format:\u003c/p\u003e\u003cpre\u003eswitch# configure convert new-syntax\u003c/pre\u003e\u003cp\u003eThe updated encrypted SNMPv3 CLI configuration follows this structure, incorporating the newly introduced \u0026quot;key \u0026lt;algo\u0026gt; \u0026lt;encrypted_text\u0026gt;\u0026quot; syntax:\u003c/p\u003e\u003cpre\u003eswitch# show running-config | grep snmp-server\nsnmp-server user alice group_alice v3 localized f5717f2cdde9bb946d00 auth sha256 key 7 005D110205085E520B754E1B591C504542585F557D2F217064607A10034752035500080755575640440F5C00505053515F08525208035C1605525E0A040E781F4D\u003c/pre\u003e\u003cp\u003eCVE-2026-73440 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nFollowing the system upgrade, users are required to execute the syntax conversion command specified below to adopt the updated, encrypted SNMPv3 CLI format:\n\n switch# configure convert new-syntax\n\nThe updated encrypted SNMPv3 CLI configuration follows this structure, incorporating the newly introduced \"key \u003calgo\u003e \u003cencrypted_text\u003e\" syntax:\n\n switch# show running-config | grep snmp-server\n snmp-server user alice group_alice v3 localized f5717f2cdde9bb946d00 auth sha256 key 7 005D110205085E520B754E1B591C504542585F557D2F217064607A10034752035500080755575640440F5C00505053515F08525208035C1605525E0A040E781F4D\n\nCVE-2026-73440 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.10M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0178",
"defects": [
"BUG 1856462",
"BUG 1966273"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0178",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation exists.\u003c/p\u003e"
}
],
"value": "No mitigation exists."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73440",
"datePublished": "2026-09-16T09:55:14.571Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-16T13:40:25.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73469 (GCVE-0-2026-73469)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:55 – Updated: 2026-09-16 13:41
VLAI
EPSS
VEX
Title
Security Advisory 0176
Summary
When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
5.8 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:41 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.35.0F , ≤ 4.35.4M
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73469",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:41:28.008891Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:41:36.781Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"7050X4 Series",
"7358X4 Series"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.35.4M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow ipv6 interface\nEthernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow running-config section ip verify\ninterface Ethernet1/1\n ip verify unicast source reachable-via any\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow running-config section ipv6 verify\ninterface Ethernet1/1\n ipv6 verify unicast source reachable-via any\u003c/pre\u003e\u003cp\u003eIf loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\nEthernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ...\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.\n\n switch\u003eshow ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...\n\n switch\u003eshow ipv6 interface\n Ethernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...\n\n switch\u003eshow running-config section ip verify\n interface Ethernet1/1\n ip verify unicast source reachable-via any\n\n switch\u003eshow running-config section ipv6 verify\n interface Ethernet1/1\n ipv6 verify unicast source reachable-via any\n\nIf loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:\n\n switch\u003eshow ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\n Ethernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ..."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:40.801Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0176",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73469 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.0F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.5M and later releases in the 4.35.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73469 has been fixed in the following releases:\n- 4.36.0F and later releases in the 4.36.x train\n- 4.35.5M and later releases in the 4.35.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0176",
"defects": [
"BUG 1353206"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0176",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation exists for this issue.\u003c/p\u003e"
}
],
"value": "No mitigation exists for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73469",
"datePublished": "2026-09-16T09:55:14.065Z",
"dateReserved": "2026-08-12T16:47:18.121Z",
"dateUpdated": "2026-09-16T13:41:36.781Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73453 (GCVE-0-2026-73453)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:46 – Updated: 2026-09-17 03:56
VLAI
EPSS
VEX
Title
Security Advisory 0174
Summary
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , < 4.34.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.30.0F , < 4.31.0F (custom) Affected: 4.29.2F , < 4.30.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73453",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:56:37.219Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThan": "4.34.0F",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.30.0F",
"status": "affected",
"version": "4.29.2F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73453, p4-runtime must be configured in one of the following combinations. P4-runtime is not a feature which runs by default and must be explicitly enabled:\u003c/p\u003e\u003cp\u003e1. Non TLS mode (p4-runtime is enabled with no ssl profile configured):\u003c/p\u003e\u003cpre\u003eswitch\u003eshow p4-runtime\nEnabled: yes\nServer: running on port 9559, in mgmtVrf VRF\nSSL profile: none\nAuthentication username priority: x509-spiffe, x509-common-name\nTotal clients: 0\nAccounting requests: no\u003c/pre\u003e\u003cp\u003e2. TLS mode (p4-runtime is enabled and ssl profile is configured with no trusted certificates):\u003c/p\u003e\u003cpre\u003eswitch\u003eshow p4-runtime\nEnabled: yes\nServer: running on port 9559, in mgmtVrf VRF\nSSL profile: campus\nAuthentication username priority: x509-spiffe, x509-common-name\nTotal clients: 0\nAccounting requests: no\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow management security ssl profile campus detail\nProfile: campus\nState: valid\nTrusted certificates: n/a\u003c/pre\u003e\u003cp\u003e3. mTLS mode (p4-runtime is enabled and ssl profile is configured with trusted certificates) + Accounting is enabled for p4-runtime service OR gNSI acctz is enabled + gNSI Authz is disabled:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow p4-runtime\nEnabled: yes\nServer: running on port 9559, in mgmtVrf VRF\nSSL profile: campus\nAuthentication username priority: x509-spiffe, x509-common-name\nTotal clients: 0\nAccounting requests: yes\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow management security ssl profile campus detail\nProfile: campus\nState: valid\nTrusted certificates:\n - clientRootCa\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow management api gnsi\nTransport: no transport configured\nAcctz enabled: yes\nAttestz enabled: no\nAuthz enabled: no\nCertz enabled: no\nCredentialz enabled: no\nEnrollz enabled: no\nPathz enabled: no\u003c/pre\u003e\u003cp\u003eIf P4Runtime is not configured there is no exposure to this issue:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow p4-runtime\nEnabled: no\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73453, p4-runtime must be configured in one of the following combinations. P4-runtime is not a feature which runs by default and must be explicitly enabled:\n\n1. Non TLS mode (p4-runtime is enabled with no ssl profile configured):\n\n switch\u003eshow p4-runtime\n Enabled: yes\n Server: running on port 9559, in mgmtVrf VRF\n SSL profile: none\n Authentication username priority: x509-spiffe, x509-common-name\n Total clients: 0\n Accounting requests: no\n\n2. TLS mode (p4-runtime is enabled and ssl profile is configured with no trusted certificates):\n\n switch\u003eshow p4-runtime\n Enabled: yes\n Server: running on port 9559, in mgmtVrf VRF\n SSL profile: campus\n Authentication username priority: x509-spiffe, x509-common-name\n Total clients: 0\n Accounting requests: no\n\n switch\u003eshow management security ssl profile campus detail\n Profile: campus\n State: valid\n Trusted certificates: n/a\n\n3. mTLS mode (p4-runtime is enabled and ssl profile is configured with trusted certificates) + Accounting is enabled for p4-runtime service OR gNSI acctz is enabled + gNSI Authz is disabled:\n\n switch\u003eshow p4-runtime\n Enabled: yes\n Server: running on port 9559, in mgmtVrf VRF\n SSL profile: campus\n Authentication username priority: x509-spiffe, x509-common-name\n Total clients: 0\n Accounting requests: yes\n\n switch\u003eshow management security ssl profile campus detail\n Profile: campus\n State: valid\n Trusted certificates:\n - clientRootCa\n\n switch\u003eshow management api gnsi\n Transport: no transport configured\n Acctz enabled: yes\n Attestz enabled: no\n Authz enabled: no\n Certz enabled: no\n Credentialz enabled: no\n Enrollz enabled: no\n Pathz enabled: no\n\nIf P4Runtime is not configured there is no exposure to this issue:\n\n switch\u003eshow p4-runtime\n Enabled: no"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.5,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:40.303Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0174",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73453 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73453 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0174",
"defects": [
"BUG 1850014"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0174",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo mitigate this issue, it is recommended to configure the p4-runtime service in mTLS mode (ssl profile with trust certificates). Additionally, enable gNSI Authz to facilitate RPC authorization via the client certificate SPIFFE-ID. Please note that enabling mTLS config will terminate all existing P4 client connections and may cause control plane disruption since packet I/O operations are impacted.\u003c/p\u003e\u003cp\u003eBefore implementing this solution, the following pre-requisites must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eGenerate SPIFFE-ID client certificate signed by the server trusted CA and use it for establishing P4 client connection to the server.\u003c/li\u003e\u003cli\u003eDefine a json file with SPIFFE-ID based policies for Authz service and install it on the device using gNSI Authz.Rotate() rpc.\u003c/li\u003e\u003c/ol\u003e\u003cpre\u003eswitch\u003eshow running-config section p4-runtime\np4-runtime\n no shutdown\n !\n transport grpc foo\n ssl profile campus\n authentication username priority x509-spiffe\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow running-config section security\nmanagement security\n ssl profile campus\n certificate server.crt key server.key\n trust certificate ca.crt\u003c/pre\u003e\u003cpre\u003eswitch\u003eshow running-config section gnsi\nmanagement api gnsi\n service authz\u003c/pre\u003e"
}
],
"value": "To mitigate this issue, it is recommended to configure the p4-runtime service in mTLS mode (ssl profile with trust certificates). Additionally, enable gNSI Authz to facilitate RPC authorization via the client certificate SPIFFE-ID. Please note that enabling mTLS config will terminate all existing P4 client connections and may cause control plane disruption since packet I/O operations are impacted.\n\nBefore implementing this solution, the following pre-requisites must be met:\n\n1. Generate SPIFFE-ID client certificate signed by the server trusted CA and use it for establishing P4 client connection to the server.\n2. Define a json file with SPIFFE-ID based policies for Authz service and install it on the device using gNSI Authz.Rotate() rpc.\n\n switch\u003eshow running-config section p4-runtime\n p4-runtime\n no shutdown\n !\n transport grpc foo\n ssl profile campus\n authentication username priority x509-spiffe\n\n switch\u003eshow running-config section security\n management security\n ssl profile campus\n certificate server.crt key server.key\n trust certificate ca.crt\n\n switch\u003eshow running-config section gnsi\n management api gnsi\n service authz"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73453",
"datePublished": "2026-09-16T09:46:33.548Z",
"dateReserved": "2026-08-12T16:42:47.921Z",
"dateUpdated": "2026-09-17T03:56:37.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73455 (GCVE-0-2026-73455)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:46 – Updated: 2026-09-16 17:56
VLAI
EPSS
VEX
Title
Security Advisory 0173
Summary
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:56 UTC
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
1.0.0 , < 4.33.0F
(custom)
Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.6M (custom) Affected: 4.35.0F , ≤ 4.35.4M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:56:02.507882Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:56:12.396Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.4M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability is exploitable when OSPFv3 is configured with at least one active neighbor:\u003c/p\u003e\n\u003cpre\u003e\nswitch\u0026gt;show ospfv3\nRouting Process \u0026quot;ospfv3\u0026quot; with ID 192.0.2.0 and Instance 0 VRF default\nIt has 1 fully adjacent neighbors\n\nswitch\u0026gt;show ospfv3 neighbor\nNeighbor 192.0.3.0 VRF default priority is 1, state is Full\n\u003c/pre\u003e"
}
],
"value": "The vulnerability is exploitable when OSPFv3 is configured with at least one active neighbor:\n\nswitch\u003eshow ospfv3\nRouting Process \"ospfv3\" with ID 192.0.2.0 and Instance 0 VRF default\nIt has 1 fully adjacent neighbors\n\nswitch\u003eshow ospfv3 neighbor\nNeighbor 192.0.3.0 VRF default priority is 1, state is Full"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly."
}
],
"impacts": [
{
"capecId": "CAPEC-231",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-231 Oversized Serialized Data Payloads"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T09:46:15.888Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24729-security-advisory-0173"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e4.33.9M and later in the 4.33.x train\u003c/li\u003e\n\u003cli\u003e4.34.7M and later in the 4.34.x train\u003c/li\u003e\n\u003cli\u003e4.35.5M and later in the 4.35.x train\u003c/li\u003e\n\u003cli\u003e4.36.1F and later in the 4.36.x train\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eA hotfix (version 1.0) is available for 4.36.0.1F, 4.35.4M, 4.34.6M, and 4.33.8M.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix:\n- 4.33.9M and later in the 4.33.x train\n- 4.34.7M and later in the 4.34.x train\n- 4.35.5M and later in the 4.35.x train\n- 4.36.1F and later in the 4.36.x train\n\nA hotfix (version 1.0) is available for 4.36.0.1F, 4.35.4M, 4.34.6M, and 4.33.8M."
}
],
"source": {
"advisory": "Security Advisory 0173",
"defects": [
"BUG1307559"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0173",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eConfigure OSPFv3 IPsec encryption to authenticate/encrypt OSPFv3 packets.\u003c/p\u003e\n\u003cp\u003ePer-interface encryption:\u003c/p\u003e\n\u003cpre\u003e\nswitch(config)# interface \u0026lt;interface-name\u0026gt;\nswitch(config-if)# ospfv3 encryption ipsec spi \u0026lt;spi-value\u0026gt; esp aes-256-cbc sha1 passphrase \u0026lt;shared-passphrase\u0026gt;\n\u003c/pre\u003e\n\u003cp\u003ePer-area encryption:\u003c/p\u003e\n\u003cpre\u003e\nswitch(config)# router ospfv3\nswitch(config-router-ospfv3)# address-family ipv4\nswitch(config-router-ospfv3-af)# area \u0026lt;area-id\u0026gt; encryption ipsec spi \u0026lt;spi-value\u0026gt; esp aes-256-cbc sha1 passphrase \u0026lt;shared-passphrase\u0026gt;\n\u003c/pre\u003e"
}
],
"value": "Configure OSPFv3 IPsec encryption to authenticate/encrypt OSPFv3 packets.\n\nPer-interface encryption:\n\nswitch(config)# interface \u003cinterface-name\u003e\nswitch(config-if)# ospfv3 encryption ipsec spi \u003cspi-value\u003e esp aes-256-cbc sha1 passphrase \u003cshared-passphrase\u003e\n\nPer-area encryption:\n\nswitch(config)# router ospfv3\nswitch(config-router-ospfv3)# address-family ipv4\nswitch(config-router-ospfv3-af)# area \u003carea-id\u003e encryption ipsec spi \u003cspi-value\u003e esp aes-256-cbc sha1 passphrase \u003cshared-passphrase\u003e"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73455",
"datePublished": "2026-09-16T09:46:15.888Z",
"dateReserved": "2026-08-12T16:45:03.510Z",
"dateUpdated": "2026-09-16T17:56:12.396Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73438 (GCVE-0-2026-73438)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:38 – Updated: 2026-09-16 18:03
VLAI
EPSS
VEX
Title
Security Advisory 0172
Summary
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:57 UTC
CWE
- CWE-617 - Reachable Assertion
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73438",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:57:36.961511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T18:03:38.266Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73438, the following condition must be met:\u003c/p\u003e\u003cp\u003eOSPFv3 must be configured:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ospfv3\nOSPFv3 address-family ipv4\nRouting Process \u0026quot;ospfv3\u0026quot; with ID 10.1.1.5 and Instance 64 VRF default\n...\nOSPFv3 address-family ipv6\nRouting Process \u0026quot;ospfv3\u0026quot; with ID 10.1.1.5 and Instance 0 VRF default\n...\u003c/pre\u003e\u003cp\u003eor\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ipv6 ospf\nRouting Process \u0026quot;ospfv3 0\u0026quot; with ID 10.1.1.5 and Instance 0 VRF default\n...\u003c/pre\u003e\u003cp\u003eIf the commands produce no output, then OSPFv3 is not configured:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ospfv3\nswitch\u003eshow ipv6 ospf\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73438, the following condition must be met:\n\nOSPFv3 must be configured:\n\n switch\u003eshow ospfv3\n OSPFv3 address-family ipv4\n Routing Process \"ospfv3\" with ID 10.1.1.5 and Instance 64 VRF default\n ...\n OSPFv3 address-family ipv6\n Routing Process \"ospfv3\" with ID 10.1.1.5 and Instance 0 VRF default\n ...\n\nor\n\n switch\u003eshow ipv6 ospf\n Routing Process \"ospfv3 0\" with ID 10.1.1.5 and Instance 0 VRF default\n ...\n\nIf the commands produce no output, then OSPFv3 is not configured:\n\n switch\u003eshow ospfv3\n switch\u003eshow ipv6 ospf"
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dravanet Inc."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.\u003c/p\u003e\u003cp\u003eThis issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.\n\nThis issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-617",
"description": "CWE-617 Reachable Assertion",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:39.787Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0172",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24728-security-advisory-0172"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73438 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73438 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.10M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0172",
"defects": [
"BUG 1876199"
],
"discovery": "EXTERNAL"
},
"title": "Security Advisory 0172",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe OSPFv3 authentication feature helps to mitigate this vulnerability. OSPFv3 authentication prevents unauthorized actors from injecting crafted packets into the OSPF domain. Enabling it on all OSPFv3-speaking interfaces ensures that packets from unauthenticated senders are discarded before they can trigger this vulnerability.\u003c/p\u003e\u003cp\u003ePer-interface OSPFv3 encryption:\u003c/p\u003e\u003cp\u003eConfigure ESP-based encryption with authentication on each OSPFv3 interface. All peers on the same interface must use the same SPI, algorithm, and passphrase.\u003c/p\u003e\u003cpre\u003eswitch(config)# interface \u0026lt;interface-name\u0026gt;\nswitch(config-if)# ospfv3 encryption ipsec spi \u0026lt;spi-value\u0026gt; esp aes-256-cbc sha1 passphrase \u0026lt;shared-passphrase\u0026gt;\u003c/pre\u003e\u003cp\u003ePer-area OSPFv3 configuration:\u003c/p\u003e\u003cp\u003eConfigure ESP-based encryption with authentication on each OSPFv3 area.\u003c/p\u003e\u003cpre\u003eswitch(config)# router ospfv3\nswitch(config-router-ospfv3)# address-family ipv4\nswitch(config-router-ospfv3-af)# area \u0026lt;area-id\u0026gt; encryption ipsec spi \u0026lt;spi-value\u0026gt; esp aes-256-cbc sha1 passphrase \u0026lt;shared-passphrase\u0026gt;\nswitch(config-router-ospfv3-af)# address-family ipv6\nswitch(config-router-ospfv3-af)# area \u0026lt;area-id\u0026gt; encryption ipsec spi \u0026lt;spi-value\u0026gt; esp aes-256-cbc sha1 passphrase \u0026lt;shared-passphrase\u0026gt;\u003c/pre\u003e\u003cp\u003eCaution: Enabling OSPFv3 authentication must be coordinated across peering neighbors simultaneously. Applying this configuration to a single peer will temporarily break the routing adjacency, resulting in traffic disruption.\u003c/p\u003e"
}
],
"value": "The OSPFv3 authentication feature helps to mitigate this vulnerability. OSPFv3 authentication prevents unauthorized actors from injecting crafted packets into the OSPF domain. Enabling it on all OSPFv3-speaking interfaces ensures that packets from unauthenticated senders are discarded before they can trigger this vulnerability.\n\nPer-interface OSPFv3 encryption:\n\nConfigure ESP-based encryption with authentication on each OSPFv3 interface. All peers on the same interface must use the same SPI, algorithm, and passphrase.\n\n switch(config)# interface \u003cinterface-name\u003e\n switch(config-if)# ospfv3 encryption ipsec spi \u003cspi-value\u003e esp aes-256-cbc sha1 passphrase \u003cshared-passphrase\u003e\n\nPer-area OSPFv3 configuration:\n\nConfigure ESP-based encryption with authentication on each OSPFv3 area.\n\n switch(config)# router ospfv3\n switch(config-router-ospfv3)# address-family ipv4\n switch(config-router-ospfv3-af)# area \u003carea-id\u003e encryption ipsec spi \u003cspi-value\u003e esp aes-256-cbc sha1 passphrase \u003cshared-passphrase\u003e\n switch(config-router-ospfv3-af)# address-family ipv6\n switch(config-router-ospfv3-af)# area \u003carea-id\u003e encryption ipsec spi \u003cspi-value\u003e esp aes-256-cbc sha1 passphrase \u003cshared-passphrase\u003e\n\nCaution: Enabling OSPFv3 authentication must be coordinated across peering neighbors simultaneously. Applying this configuration to a single peer will temporarily break the routing adjacency, resulting in traffic disruption."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73438",
"datePublished": "2026-09-16T09:38:57.955Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-16T18:03:38.266Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73436 (GCVE-0-2026-73436)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:19 – Updated: 2026-09-16 13:50
VLAI
EPSS
VEX
Title
Security Advisory 0171
Summary
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:50 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7.1M (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:50:10.659104Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:50:22.868Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010 Series",
"7010X Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7150 Series",
"7160 Series",
"7170 Series",
"7050X/X2/X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7250X Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73436, the following condition must be met:\u003c/p\u003e\u003cp\u003eOSPFv2 segment routing must be configured. If the below command shows any OSPF instance, then the deployment is vulnerable.\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf segment-routing\nSPF Instance ID: 1\n...\u003c/pre\u003e\u003cp\u003eIf OSPFv2 segment routing is not configured, then there is no exposure to this issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73436, the following condition must be met:\n\nOSPFv2 segment routing must be configured. If the below command shows any OSPF instance, then the deployment is vulnerable.\n\n switch\u003eshow ip ospf segment-routing\n SPF Instance ID: 1\n ...\n\nIf OSPFv2 segment routing is not configured, then there is no exposure to this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.\u003c/p\u003e\u003cp\u003eThese issues were discovered internally by Arista, and the company is not aware of any malicious uses of these issues in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1284",
"description": "CWE-1284 Improper Validation of Specified Quantity in Input",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:39.211Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0171",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73436 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for CVE-2026-73436.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73436 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.10M and later releases in the 4.33.x train\n\nNo hotfix is available for CVE-2026-73436."
}
],
"source": {
"advisory": "Security Advisory 0171",
"defects": [
"BUG 1843812"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0171",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation is available for CVE-2026-73436.\u003c/p\u003e"
}
],
"value": "No mitigation is available for CVE-2026-73436."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73436",
"datePublished": "2026-09-16T09:19:47.800Z",
"dateReserved": "2026-08-12T16:39:35.976Z",
"dateUpdated": "2026-09-16T13:50:22.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73435 (GCVE-0-2026-73435)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:19 – Updated: 2026-09-16 15:29
VLAI
EPSS
VEX
Title
Security Advisory 0171
Summary
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:28 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.9M (custom) Affected: 1.0.0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T15:28:37.069647Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:29:43.316Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010 Series",
"7010X Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7150 Series",
"7160 Series",
"7170 Series",
"7050X/X2/X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7250X Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73435, all of the following conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eThe vulnerable OSPFv2 instance must have at least two neighbors on the same interface.\u003c/li\u003e\u003cli\u003eThe interface is a broadcast interface.\u003c/li\u003e\u003cli\u003eOSPFv2 cryptographic authentication is configured.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eHere is an example showing a vulnerable OSPFv2 instance with a minimum of two neighbors on the same interface:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf neighbor\nNeighbor ID Instance VRF ... Interface\nX.X.X.X X ... ... \u0026lt;intf\u0026gt;\nX.X.X.X X ... ... \u0026lt;intf\u0026gt;\u003c/pre\u003e\u003cp\u003eHere is an example showing the vulnerable configuration of Network Type \u0026quot;Broadcast\u0026quot; and Message-digest authentication (cryptographic authentication) configured:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf interface\n\u0026lt;intf\u0026gt; is up\n Interface Address X.X.X.X/X, instance X, VRF X, Area X.X.X.X\n Network Type Broadcast, Cost: X\n ...\n Message-digest authentication, using key id X\n ...\u003c/pre\u003e\u003cp\u003eNote: Both \u0026quot;Message-digest authentication\u0026quot; (MD5) and \u0026quot;Message-digest sha\u0026lt;X\u0026gt; authentication\u0026quot; (SHA) are vulnerable.\u003c/p\u003e\u003cp\u003eTo check area-level authentication, reference the vulnerable interface area ID in \u0026quot;show ip ospf\u0026quot; output:\u003c/p\u003e\u003cpre\u003eswitch\u003eshow ip ospf\nOSPF instance X with ID X.X.X.X VRF X\n...\nArea X.X.X.X\n Number of interface in this area is X\n It is a X area\n Traffic engineering is disabled\n Area has MD5 authentication\u003c/pre\u003e\u003cp\u003eIf the area has \u0026quot;Simple\u0026quot; or \u0026quot;None\u0026quot; authentication, then at the area-level, the third prerequisite is unmet and the system would not be vulnerable to this particular issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73435, all of the following conditions must be met:\n\n1. The vulnerable OSPFv2 instance must have at least two neighbors on the same interface.\n2. The interface is a broadcast interface.\n3. OSPFv2 cryptographic authentication is configured."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.\u003c/p\u003e\u003cp\u003eThese issues were discovered internally by Arista, and the company is not aware of any malicious uses of these issues in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345 Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:38.708Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0171",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73435 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eA hotfix is available for the following releases: 4.36.1F, 4.35.5M, 4.34.7M, 4.33.9M.\u003cbr\u003eURL: https://www.arista.com/support/advisories-notices/sa-download/?sa171-SecurityAdvisory171_CVE-2026-73435.swix\u003cbr\u003eSWIX hash (SHA512): 4c4ff053d8165f347b45dfcafc2d20396e3eb00869b0088f3128be7f53b2a028b479fa8279849c800b5916ab9aaf8077718a68e3bf4277d55b44076650de0aa7\u003cbr\u003eNote: Installing/uninstalling the SWIX will cause the Ospf process to restart.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73435 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.7.1M and later releases in the 4.34.x train\n- 4.33.10M and later releases in the 4.33.x train\n\nA hotfix is available for the following releases: 4.36.1F, 4.35.5M, 4.34.7M, 4.33.9M.\nURL: https://www.arista.com/support/advisories-notices/sa-download/?sa171-SecurityAdvisory171_CVE-2026-73435.swix\nSWIX hash (SHA512): 4c4ff053d8165f347b45dfcafc2d20396e3eb00869b0088f3128be7f53b2a028b479fa8279849c800b5916ab9aaf8077718a68e3bf4277d55b44076650de0aa7\nNote: Installing/uninstalling the SWIX will cause the Ospf process to restart."
}
],
"source": {
"advisory": "Security Advisory 0171",
"defects": [
"BUG 1843809"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0171",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation is available for CVE-2026-73435.\u003c/p\u003e"
}
],
"value": "No mitigation is available for CVE-2026-73435."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73435",
"datePublished": "2026-09-16T09:19:47.285Z",
"dateReserved": "2026-08-12T16:39:35.976Z",
"dateUpdated": "2026-09-16T15:29:43.316Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19640 (GCVE-0-2026-19640)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:11 – Updated: 2026-09-16 13:57
VLAI
EPSS
VEX
Title
Security Advisory 0170
Summary
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:55 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.0.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.24.0F , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19640",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:55:08.082343Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:57:56.343Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.24.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-19640, OpenConfig with authorized requests must be configured:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: oc\nQoS DSCP: none\nConnection limit: 100\nAuthorization required: yes\nAccounting requests: no\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\nConfig-commands AAA accounting: enabled\nConfig-commands AAA authorization: enabled\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-19640, OpenConfig with authorized requests must be configured:\n\n switch#show man api gnmi\n Transport: default\n Enabled: yes\n Server: running on port 6030, in default VRF\n SSL profile: oc\n QoS DSCP: none\n Connection limit: 100\n Authorization required: yes\n Accounting requests: no\n Notification timestamp: last change time\n Listen addresses: ::\n Authentication username priority: x509-spiffe, metadata, x509-common-name\n Config-commands AAA accounting: enabled\n Config-commands AAA authorization: enabled"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:38.207Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0170",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-19640 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-19640 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0170",
"defects": [
"BUG 1602635",
"BUG 1602639"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0170",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability can be mitigated by performing both of the following actions.\u003c/p\u003e\u003cp\u003e1. Kill gNMI subscriptions after AAA authorization policy changes. Run the following command to kill gNMI subscriptions to OpenConfig/Octa on port 6030. If a different port than the default of 6030 is being used for OpenConfig/Octa, adjust accordingly to that port:\u003c/p\u003e\u003cpre\u003eswitch#bash ss -tnp dport = 6030 | grep -o \u0027pid=[0-9]*\u0027 | cut -d= -f2 | xargs sudo kill\u003c/pre\u003e\u003cp\u003eNote: the port that OpenConfig/Octa is running the gNMI transport on is available in the output of the \u0026quot;show man api gnmi\u0026quot; CLI command (see above under the \u0026quot;Server:\u0026quot; field).\u003c/p\u003e\u003cp\u003e2. Use username and password based authentication (as opposed to mTLS) for gNMI requests to OpenConfig/Octa. The following command is an example using Arista\u0027s gNMI client:\u003c/p\u003e\u003cpre\u003egnmi -username bob -password myPass123 -addr 127.0.0.1 subscribe /system/state\u003c/pre\u003e\u003cp\u003eFor a transport running mTLS, mTLS can be disabled for this transport by any of the configurations described below:\u003c/p\u003e\u003cp\u003ea. Configure the SSL profile to use TLS instead of mTLS. This can be done by removing the trusted certificates from the SSL profile, using the \u0026quot;no trust certificate \u0026lt;name\u0026gt;\u0026quot; CLI command within the SSL profile.\u003c/p\u003e\u003cp\u003eFor example, if an SSL profile has configuration like:\u003c/p\u003e\u003cpre\u003emanagement security\n ssl profile XXY\n certificate x.crt key x.key\n trust certificate A.crt\n trust certificate B.crt\u003c/pre\u003e\u003cp\u003eThen this profile can be changed from mTLS to TLS by removing each of the trusted certificates:\u003c/p\u003e\u003cpre\u003eswitch#configure\nswitch(config)#management security\nswitch(config-mgmt-security)#ssl profile XXY\nswitch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate A.crt\nswitch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate B.crt\u003c/pre\u003e\u003cp\u003eb. Configure the OpenConfig/Octa transport to use an insecure server instead of mTLS, by removing the SSL profile config from the \u0026quot;transport grpc \u0026lt;name\u0026gt;\u0026quot; mode:\u003c/p\u003e\u003cpre\u003eswitch#configure\nswitch(config)#management api gnmi\nswitch(config-mgmt-api-gnmi)#transport grpc default\nswitch(config-gnmi-transport-default)#no ssl profile\u003c/pre\u003e"
}
],
"value": "The vulnerability can be mitigated by performing both of the following actions.\n\n1. Kill gNMI subscriptions after AAA authorization policy changes. Run the following command to kill gNMI subscriptions to OpenConfig/Octa on port 6030. If a different port than the default of 6030 is being used for OpenConfig/Octa, adjust accordingly to that port:\n\n switch#bash ss -tnp dport = 6030 | grep -o \u0027pid=[0-9]*\u0027 | cut -d= -f2 | xargs sudo kill\n\nNote: the port that OpenConfig/Octa is running the gNMI transport on is available in the output of the \"show man api gnmi\" CLI command (see above under the \"Server:\" field).\n\n2. Use username and password based authentication (as opposed to mTLS) for gNMI requests to OpenConfig/Octa. The following command is an example using Arista\u0027s gNMI client:\n\n gnmi -username bob -password myPass123 -addr 127.0.0.1 subscribe /system/state\n\nFor a transport running mTLS, mTLS can be disabled for this transport by any of the configurations described below:\n\na. Configure the SSL profile to use TLS instead of mTLS. This can be done by removing the trusted certificates from the SSL profile, using the \"no trust certificate \u003cname\u003e\" CLI command within the SSL profile.\n\nFor example, if an SSL profile has configuration like:\n\n management security\n ssl profile XXY\n certificate x.crt key x.key\n trust certificate A.crt\n trust certificate B.crt\n\nThen this profile can be changed from mTLS to TLS by removing each of the trusted certificates:\n\n switch#configure\n switch(config)#management security\n switch(config-mgmt-security)#ssl profile XXY\n switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate A.crt\n switch(config-mgmt-sec-ssl-profile-XXY)#no trust certificate B.crt\n\nb. Configure the OpenConfig/Octa transport to use an insecure server instead of mTLS, by removing the SSL profile config from the \"transport grpc \u003cname\u003e\" mode:\n\n switch#configure\n switch(config)#management api gnmi\n switch(config-mgmt-api-gnmi)#transport grpc default\n switch(config-gnmi-transport-default)#no ssl profile"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-19640",
"datePublished": "2026-09-16T09:11:32.329Z",
"dateReserved": "2026-08-12T16:48:12.259Z",
"dateUpdated": "2026-09-16T13:57:56.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73463 (GCVE-0-2026-73463)
Vulnerability from cvelistv5 – Published: 2026-09-16 09:02 – Updated: 2026-09-16 13:59
VLAI
EPSS
VEX
Title
Security Advisory 0169
Summary
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 13:59 UTC
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.0.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.32.0F , ≤ 4.32.11M (custom) Affected: 4.31.0F , ≤ 4.31.10M (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T13:59:22.097938Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T13:59:32.239Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.32.11M",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.31.10M",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnsi\nTransport: default\nTransport enabled: yes\nServer: running on port 6030, in default VRF\n\nTransport: other\nTransport enabled: yes\nServer: running on port 6031, in default VRF\n\nAcctz enabled: no\nAttestz enabled: no\nAuthz enabled: yes\nCertz enabled: no\nCredentialz enabled: no\nEnrollz enabled: no\nPathz enabled: no\u003c/pre\u003e\u003cp\u003ePlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \u0026quot;other\u0026quot; transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\n\n switch#show man api gnsi\n Transport: default\n Transport enabled: yes\n Server: running on port 6030, in default VRF\n\n Transport: other\n Transport enabled: yes\n Server: running on port 6031, in default VRF\n\n Acctz enabled: no\n Attestz enabled: no\n Authz enabled: yes\n Certz enabled: no\n Credentialz enabled: no\n Enrollz enabled: no\n Pathz enabled: no\n\nPlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \"other\" transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:37.649Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0169",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24725-security-advisory-0169"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73463 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73463 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.7.1M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0169",
"defects": [
"BUG 1602636"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0169",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\u003c/p\u003e\u003cp\u003eFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\u003c/p\u003e\u003cpre\u003eswitch(config)#aaa authorization commands all default local\nswitch(config)#aaa authorization config-commands\u003c/pre\u003e\u003cp\u003eNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\u003c/p\u003e\u003cpre\u003eswitch(config-mgmt-api-gnsi)#role network-operator\nswitch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\n256 permit command .*\u003c/pre\u003e"
}
],
"value": "Restrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\n\nFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\n\n switch(config)#aaa authorization commands all default local\n switch(config)#aaa authorization config-commands\n\nNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\n\n switch(config-mgmt-api-gnsi)#role network-operator\n switch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\n 256 permit command .*"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73463",
"datePublished": "2026-09-16T09:02:19.908Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-16T13:59:32.239Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73445 (GCVE-0-2026-73445)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:58 – Updated: 2026-09-16 17:35
VLAI
EPSS
VEX
Title
Security Advisory 0167
Summary
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Severity
4.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 17:35 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.0.1F
(custom)
Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73445",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T17:35:46.330735Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T17:35:56.813Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73445, gNSI Authz must be configured on an OpenConfig gRPC transport:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnsi\nTransport: default\nTransport enabled: yes\nServer: running on port 6030, in default VRF\n\nAcctz enabled: no\nAttestz enabled: no\nAuthz enabled: yes\nCertz enabled: no\nCredentialz enabled: no\nEnrollz enabled: no\nPathz enabled: no\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73445, gNSI Authz must be configured on an OpenConfig gRPC transport:\n\n switch#show man api gnsi\n Transport: default\n Transport enabled: yes\n Server: running on port 6030, in default VRF\n\n Acctz enabled: no\n Attestz enabled: no\n Authz enabled: yes\n Certz enabled: no\n Credentialz enabled: no\n Enrollz enabled: no\n Pathz enabled: no"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:37.145Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0167",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24723-security-advisory-0167"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73445 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73445 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0167",
"defects": [
"BUG 1602625"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0167",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Include exactly one UploadRequest in a gNSI Authz Rotate request.\u003c/p\u003e\u003cp\u003e2. Use a gNSI Authz policy that restricts gNSI Authz use to only those who strictly need it. Below is an example policy that only allows user \u0026quot;Neo\u0026quot; to rotate Authz policies:\u003c/p\u003e\u003cpre\u003e{\n \"name\":\"restrict-authz-policy\",\n \"allow_rules\":[\n {\n \"name\":\"neoallow\",\n \"request\":{\n \"paths\":[\n \"/gnsi.authz.v1.Authz/Rotate\"\n ],\n \"headers\":[\n {\n \"key\":\"username\",\n \"values\":[\n \"Neo\"\n ]\n }\n ]\n }\n },\n {\n \"name\":\"allow-gnmi\",\n \"request\":{\n \"paths\":[\n \"/gnmi.gNMI/*\"\n ]\n }\n },\n {\n \"name\":\"allow-gnoi\",\n \"request\":{\n \"paths\":[\n \"/gnoi.*\"\n ]\n }\n }\n ]\n}\u003c/pre\u003e\u003cp\u003eIdeally, this policy would be uploaded via a gNSI client for correct version and created-on metadata handling. However, the policy can also be written directly to the active policy file:\u003c/p\u003e\u003cpre\u003eswitch#bash timeout 100 echo \"{\\\"name\\\":\\\"restrict-authz-policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"neoallow\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnsi.authz.v1.Authz\\/Rotate\\\"],\\\"headers\\\":[{\\\"key\\\":\\\"username\\\",\\\"values\\\":[\\\"Neo\\\"]}]}},{\\\"name\\\":\\\"allow-gnmi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnmi.gNMI\\/*\\\"]}},{\\\"name\\\":\\\"allow-gnoi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnoi.*\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026amp;\u0026amp; sleep 11\u003c/pre\u003e"
}
],
"value": "1. Include exactly one UploadRequest in a gNSI Authz Rotate request.\n\n2. Use a gNSI Authz policy that restricts gNSI Authz use to only those who strictly need it. Below is an example policy that only allows user \"Neo\" to rotate Authz policies:\n\n {\n \"name\":\"restrict-authz-policy\",\n \"allow_rules\":[\n {\n \"name\":\"neoallow\",\n \"request\":{\n \"paths\":[\n \"/gnsi.authz.v1.Authz/Rotate\"\n ],\n \"headers\":[\n {\n \"key\":\"username\",\n \"values\":[\n \"Neo\"\n ]\n }\n ]\n }\n },\n {\n \"name\":\"allow-gnmi\",\n \"request\":{\n \"paths\":[\n \"/gnmi.gNMI/*\"\n ]\n }\n },\n {\n \"name\":\"allow-gnoi\",\n \"request\":{\n \"paths\":[\n \"/gnoi.*\"\n ]\n }\n }\n ]\n }\n\nIdeally, this policy would be uploaded via a gNSI client for correct version and created-on metadata handling. However, the policy can also be written directly to the active policy file:\n\n switch#bash timeout 100 echo \"{\\\"name\\\":\\\"restrict-authz-policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"neoallow\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnsi.authz.v1.Authz\\/Rotate\\\"],\\\"headers\\\":[{\\\"key\\\":\\\"username\\\",\\\"values\\\":[\\\"Neo\\\"]}]}},{\\\"name\\\":\\\"allow-gnmi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnmi.gNMI\\/*\\\"]}},{\\\"name\\\":\\\"allow-gnoi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnoi.*\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json \u0026\u0026 sleep 11"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73445",
"datePublished": "2026-09-16T08:58:51.242Z",
"dateReserved": "2026-08-12T16:42:47.920Z",
"dateUpdated": "2026-09-16T17:35:56.813Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2380 (GCVE-0-2026-2380)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:48 – Updated: 2026-09-16 14:07
VLAI
EPSS
VEX
Title
Security Advisory 0168
Summary
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include:
- Sensitive CLI commands (e.g., "username bob secret myPass")
- Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 14:01 UTC
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0F , ≤ 4.36.1F
(custom)
Affected: 4.35.0F , < 4.36.0F (custom) Affected: 4.34.0F , < 4.35.0F (custom) Affected: 4.33.0F , < 4.34.0F (custom) Affected: 0 , < 4.33.0F (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T14:01:30.909167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T14:07:36.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series running EOS",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
},
{
"lessThan": "4.36.0F",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThan": "4.35.0F",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThan": "4.34.0F",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable to CVE-2026-2380, any of the following configurations must be present:\u003c/p\u003e\u003col\u003e\u003cli\u003egNMI server is enabled\u003c/li\u003e\u003cli\u003eRESTCONF server is enabled\u003c/li\u003e\u003cli\u003eNETCONF server is enabled\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\u003c/p\u003e\u003cp\u003egNMI server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\u003c/pre\u003e\u003cp\u003eRESTCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section restconf\nmanagement api restconf\n transport https default\n ssl profile mySslProfile\u003c/pre\u003e\u003cp\u003eNETCONF server enabled:\u003c/p\u003e\u003cpre\u003e#show running-config section netconf\nmanagement api netconf\n transport ssh default\u003c/pre\u003e\u003cp\u003eIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\u003c/p\u003e\u003cp\u003egRPC AAA accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\n accounting requests\u003c/pre\u003e\u003cp\u003egNSI.Acctz accounting sensitive logging (for gNMI only):\u003c/p\u003e\u003cpre\u003e#show running-config section gnmi\nmanagement api gnmi\n transport grpc default\n#show running-config section gnsi\nmanagement api gnsi\n service acctz\u003c/pre\u003e\u003cp\u003eOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\u003c/p\u003e\u003cpre\u003e#\ntrace OpenConfig setting */*\u003c/pre\u003e\u003cp\u003eOcta agent with debug tracing enabled (at any level):\u003c/p\u003e\u003cpre\u003e#show running-config section trace | grep Octa\ntrace Octa setting */*\u003c/pre\u003e"
}
],
"value": "To be vulnerable to CVE-2026-2380, any of the following configurations must be present:\n\n1. gNMI server is enabled\n2. RESTCONF server is enabled\n3. NETCONF server is enabled\n\nWith any of these servers enabled, the OpenConfig/Octa agent can log sensitive information in the local log file.\n\ngNMI server enabled:\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n\nRESTCONF server enabled:\n\n #show running-config section restconf\n management api restconf\n transport https default\n ssl profile mySslProfile\n\nNETCONF server enabled:\n\n #show running-config section netconf\n management api netconf\n transport ssh default\n\nIn addition to local logging, sensitive information may be recorded on remote accounting servers if any of the following configurations are present:\n\ngRPC AAA accounting sensitive logging (for gNMI only):\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n accounting requests\n\ngNSI.Acctz accounting sensitive logging (for gNMI only):\n\n #show running-config section gnmi\n management api gnmi\n transport grpc default\n #show running-config section gnsi\n management api gnsi\n service acctz\n\nOpenConfig agent tracing sensitive logging (debug tracing enabled at any level):\n\n #\n trace OpenConfig setting */*\n\nOcta agent with debug tracing enabled (at any level):\n\n #show running-config section trace | grep Octa\n trace Octa setting */*"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eExamples of sensitive information include:\u003c/p\u003e\u003cul\u003e\u003cli\u003eSensitive CLI commands (e.g., \u0026quot;username bob secret myPass\u0026quot;)\u003c/li\u003e\u003cli\u003eSensitive OpenConfig YANG leafs (e.g., \u0026quot;system/aaa/global/tacacs/config/secret-key\u0026quot;)\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.\n\nExamples of sensitive information include:\n- Sensitive CLI commands (e.g., \"username bob secret myPass\")\n- Sensitive OpenConfig YANG leafs (e.g., \"system/aaa/global/tacacs/config/secret-key\")\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T10:13:36.641Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0168",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24724-security-advisory-0168"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-2380 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-2380 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n\nNo hotfix is available for this issue."
}
],
"source": {
"advisory": "Security Advisory 0168",
"defects": [
"BUG 1207374"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0168",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \u0026quot;trace OpenConfig setting */*\u0026quot; or \u0026quot;trace Octa setting */*\u0026quot;; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\u003c/p\u003e\u003cp\u003eShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up OpenConfig and Octa log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\u003c/pre\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete\u003c/pre\u003e"
}
],
"value": "The vulnerability can be mitigated by avoiding the transmission of requests containing sensitive information over gNMI, RESTCONF, or NETCONF. Additionally, debug tracing for the OpenConfig or Octa agents should not be enabled, i.e., do not configure \"trace OpenConfig setting */*\" or \"trace Octa setting */*\"; please note that this can only avoid sensitive information showing in the debug traces, but can not mitigate the issue cause by other configurations mentioned in the Required Configuration for Exploitation section.\n\nShould it be determined that sensitive information has been logged, the affected log files must be truncated and any compromised secrets rotated to prevent unauthorized credential usage.\n\nUse the following commands to clean up OpenConfig and Octa log files:\n\n switch(config)# bash sudo truncate -s 0 /var/log/agents/OpenConfig*\n switch(config)# bash sudo truncate -s 0 /var/log/agents/Octa*\n\nThen use the following commands to clean up previously rotated old log files:\n\n switch(config)# bash sudo find /var/log/agents -name \u0027OpenConfig*.gz\u0027 -type f -delete\n switch(config)# bash sudo find /var/log/agents -name \u0027Octa*.gz\u0027 -type f -delete"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-2380",
"datePublished": "2026-09-16T08:48:53.473Z",
"dateReserved": "2026-02-11T21:25:18.920Z",
"dateUpdated": "2026-09-16T14:07:36.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73464 (GCVE-0-2026-73464)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:32 – Updated: 2026-09-17 03:56
VLAI
EPSS
VEX
Title
Security Advisory 0166
Summary
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.29.0F , < 4.30.0F
(custom)
Affected: 4.30.0F , < 4.31.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:56:52.621Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series (EOS)",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange, virtual or physical appliance"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.30.0F",
"status": "affected",
"version": "4.29.0F",
"versionType": "custom"
},
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73464, the following condition must be met:\u003c/p\u003e\u003cp\u003egNMI transport must be enabled:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#show management api gnmi\nTransport: default\nEnabled: yes\nServer: running on port 6030, in default VRF\nSSL profile: none\nQoS DSCP: none\nConnection limit: 100\nAuthorization required: no\nAccounting requests: no\nNotification timestamp: last change time\nListen addresses: ::\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\nConfig-commands AAA accounting: enabled\nConfig-commands AAA authorization: enabled\n\u003c/pre\u003e\u003cp\u003eIf a gNMI transport is not configured there is no exposure to this issue and the message will look something like:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#show management api gnmi\nEnabled: no transports enabled\n\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73464, the following condition must be met:\n\ngNMI transport must be enabled:\n\n switch(config)#show management api gnmi\n Transport: default\n Enabled: yes\n Server: running on port 6030, in default VRF\n SSL profile: none\n QoS DSCP: none\n Connection limit: 100\n Authorization required: no\n Accounting requests: no\n Notification timestamp: last change time\n Listen addresses: ::\n Authentication username priority: x509-spiffe, metadata, x509-common-name\n Config-commands AAA accounting: enabled\n Config-commands AAA authorization: enabled\n\nIf a gNMI transport is not configured there is no exposure to this issue and the message will look something like:\n\n switch(config)#show management api gnmi\n Enabled: no transports enabled"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:32:54.304Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Networks Security Advisory 0166",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix for this vulnerability:\n - 4.33.9M and later releases in the 4.33.x train\n - 4.34.7.1M and later releases in the 4.34.x train\n - 4.35.6M and later releases in the 4.35.x train\n - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
}
],
"source": {
"advisory": "Security Advisory 0166",
"defects": [
"BUG 1602598",
"BUG 1966288"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0166",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable any gNMI transports:\u003c/p\u003e\u003cpre\u003e\nmanagement api gnmi\n no transport grpc \u0026lt;name\u0026gt;\n\u003c/pre\u003e\u003cp\u003eDisabling all gNMI transports makes gNMI, gNOI, and gNSI services unavailable. If no RESTCONF or NETCONF transports are configured, the OpenConfig/Octa agent will also stop. CloudVision provisioning via TerminAttr is unaffected. All services resume when a gNMI transport is re-enabled.\u003c/p\u003e\u003cp\u003eNote: This mitigation is not applicable to DMF-managed EOS switches. gNMI transports are enabled by default on these platforms and cannot be disabled.\u003c/p\u003e"
}
],
"value": "Disable any gNMI transports:\n\n management api gnmi\n no transport grpc \u003cname\u003e\n\nDisabling all gNMI transports makes gNMI, gNOI, and gNSI services unavailable. If no RESTCONF or NETCONF transports are configured, the OpenConfig/Octa agent will also stop. CloudVision provisioning via TerminAttr is unaffected. All services resume when a gNMI transport is re-enabled.\n\nNote: This mitigation is not applicable to DMF-managed EOS switches. gNMI transports are enabled by default on these platforms and cannot be disabled."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73464",
"datePublished": "2026-09-16T08:32:54.304Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-17T03:56:52.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73454 (GCVE-0-2026-73454)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:14 – Updated: 2026-09-17 03:56
VLAI
EPSS
VEX
Title
Security Advisory 0165
Summary
On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.30.0F , < 4.31.0F
(custom)
Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:56:53.682Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series (EOS)",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73454, the following condition must be met:\u003c/p\u003e\u003cp\u003egNSI Credentialz must be enabled (Note: gNSI Credentialz is disabled by default):\u003c/p\u003e\u003cpre\u003e\nswitch(config)#show management api gnsi\nTransport: default\nTransport enabled: yes\nServer: running on port 6030, in default VRF\n\nAcctz enabled: no\nAttestz enabled: no\nAuthz enabled: no\nCertz enabled: no\nCredentialz enabled: yes\nEnrollz enabled: no\nPathz enabled: no\n\u003c/pre\u003e\u003cp\u003eIf Credentialz is not enabled there is no exposure to this issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73454, the following condition must be met:\n\ngNSI Credentialz must be enabled (Note: gNSI Credentialz is disabled by default):\n\n switch(config)#show management api gnsi\n Transport: default\n Transport enabled: yes\n Server: running on port 6030, in default VRF\n\n Acctz enabled: no\n Attestz enabled: no\n Authz enabled: no\n Certz enabled: no\n Credentialz enabled: yes\n Enrollz enabled: no\n Pathz enabled: no\n\nIf Credentialz is not enabled there is no exposure to this issue."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account\u0027s properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account\u0027s properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:14:40.485Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Networks Security Advisory 0165",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24721-security-advisory-0165"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix for this vulnerability:\n - 4.33.9M and later releases in the 4.33.x train\n - 4.34.7.1M and later releases in the 4.34.x train\n - 4.35.6M and later releases in the 4.35.x train\n - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
}
],
"source": {
"advisory": "Security Advisory 0165",
"defects": [
"BUG 1602633"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0165",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDisable gNSI Credentialz service. Note: Disabling Credentialz prevents gNSI-based credential rotation (SSH keys, passwords, host parameters) but does not affect traditional EOS CLI credential management. Credentialz is not enabled by default.\u003c/p\u003e\u003cpre\u003e\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#no service credentialz\n\u003c/pre\u003e"
}
],
"value": "Disable gNSI Credentialz service. Note: Disabling Credentialz prevents gNSI-based credential rotation (SSH keys, passwords, host parameters) but does not affect traditional EOS CLI credential management. Credentialz is not enabled by default.\n\n switch(config)#management api gnsi\n switch(config-mgmt-api-gnsi)#no service credentialz"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73454",
"datePublished": "2026-09-16T08:14:40.485Z",
"dateReserved": "2026-08-12T16:42:47.921Z",
"dateUpdated": "2026-09-17T03:56:53.682Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73439 (GCVE-0-2026-73439)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:09 – Updated: 2026-09-17 03:56
VLAI
EPSS
VEX
Title
Security Advisory 0164
Summary
On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-842 - Placement of User into Incorrect Group
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.33.2F , ≤ 4.33.8M
(custom)
Affected: 4.34.0F , ≤ 4.34.6M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73439",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:56:54.834Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series (EOS)",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.2F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.6M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAll of the following conditions must be met for this vulnerability to be exploitable:\u003c/p\u003e\u003col\u003e\u003cli\u003eOpenConfig must be configured with a gNMI transport started. The running configuration will include:\u003cpre\u003e\nmanagement api gnmi\n transport grpc \u0026lt;name\u0026gt;\n\u003c/pre\u003e\u003c/li\u003e\u003cli\u003egNSI must be configured with the gNSI Pathz service enabled. The running configuration will include:\u003cpre\u003e\nmanagement api gnsi\n service pathz\n\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eA Pathz policy must be present on the system at \u003ccode\u003e/persist/sys/gnsi/pathz/policy.json\u003c/code\u003e, and that policy must contain at least one group rule and at least one user rule for the same path.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eTo verify the presence of the policy file:\u003c/p\u003e\u003cpre\u003e\nswitch\u0026gt;enable\nswitch#bash stat /persist/sys/gnsi/pathz/policy.json\n\u003c/pre\u003e"
}
],
"value": "All of the following conditions must be met for this vulnerability to be exploitable:\n\n1. OpenConfig must be configured with a gNMI transport started. The running configuration will include:\n\n management api gnmi\n transport grpc \u003cname\u003e\n\n2. gNSI must be configured with the gNSI Pathz service enabled. The running configuration will include:\n\n management api gnsi\n service pathz\n\n3. A Pathz policy must be present on the system at /persist/sys/gnsi/pathz/policy.json, and that policy must contain at least one group rule and at least one user rule for the same path.\n\nTo verify the presence of the policy file:\n\n switch\u003eenable\n switch#bash stat /persist/sys/gnsi/pathz/policy.json"
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-842",
"description": "CWE-842 Placement of User into Incorrect Group",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:09:11.553Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Networks Security Advisory 0164",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24720-security-advisory-0164"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix for this vulnerability:\n - 4.33.9M and later releases in the 4.33.x train\n - 4.34.7M and later releases in the 4.34.x train\n - 4.35.6M and later releases in the 4.35.x train\n - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
}
],
"source": {
"advisory": "Security Advisory 0164",
"defects": [
"BUG 1602638"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0164",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eOption 1:\u003c/strong\u003e Disable gNSI Pathz entirely:\u003c/p\u003e\u003cpre\u003e\nswitch#configure\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#no service pathz\n\u003c/pre\u003e\u003cp\u003e\u003cstrong\u003eOption 2:\u003c/strong\u003e Push a new gNSI Pathz policy that does not contain any group rules, using only user-principal rules. To push a new policy via grpcurl:\u003c/p\u003e\u003cpre\u003e\ngrpcurl -protoset ./pathz.proto.pb -H \u0027username:$USER\u0027 -v -d @ -plaintext $TARGET:$PORT gnsi.pathz.v1.Pathz/Rotate \u0026lt;\u0026lt; EOF\n{\n \"upload_request\": {\n \"version\": \"\u0026lt;version\u0026gt;\",\n \"created_on\": \u0026lt;timestamp\u0026gt;,\n \"policy\": \u0026lt;policy\u0026gt;\n }\n}\n{\n \"finalize_rotation\": {}\n}\nEOF\n\u003c/pre\u003e\u003cp\u003eEnsure all rules in the policy use \u003ccode\u003euser\u003c/code\u003e as the principal rather than \u003ccode\u003egroup\u003c/code\u003e to avoid triggering this vulnerability.\u003c/p\u003e"
}
],
"value": "Option 1: Disable gNSI Pathz entirely:\n\n switch#configure\n switch(config)#management api gnsi\n switch(config-mgmt-api-gnsi)#no service pathz\n\nOption 2: Push a new gNSI Pathz policy that does not contain any group rules, using only user-principal rules. To push a new policy via grpcurl:\n\n grpcurl -protoset ./pathz.proto.pb -H \u0027username:$USER\u0027 -v -d @ -plaintext $TARGET:$PORT gnsi.pathz.v1.Pathz/Rotate \u003c\u003c EOF\n {\n \"upload_request\": {\n \"version\": \"\u003cversion\u003e\",\n \"created_on\": \u003ctimestamp\u003e,\n \"policy\": \u003cpolicy\u003e\n }\n }\n {\n \"finalize_rotation\": {}\n }\n EOF\n\nEnsure all rules in the policy use \"user\" as the principal rather than \"group\" to avoid triggering this vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73439",
"datePublished": "2026-09-16T08:09:11.553Z",
"dateReserved": "2026-08-12T16:39:35.977Z",
"dateUpdated": "2026-09-17T03:56:54.834Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73461 (GCVE-0-2026-73461)
Vulnerability from cvelistv5 – Published: 2026-09-16 08:01 – Updated: 2026-09-17 03:56
VLAI
EPSS
VEX
Title
Security Advisory 0163
Summary
On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 00:00 UTC
CWE
- CWE-266 - Incorrect Privilege Assignment
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.29.0F , < 4.30.0F
(custom)
Affected: 4.30.0F , < 4.31.0F (custom) Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , ≤ 4.32.11M (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73461",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T03:56:55.952Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D Series",
"720XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series (EOS)",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThan": "4.30.0F",
"status": "affected",
"version": "4.29.0F",
"versionType": "custom"
},
{
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.0F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.32.11M",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following conditions must both be met for this vulnerability to be exploitable:\u003c/p\u003e\u003col\u003e\u003cli\u003eOpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\u003cpre\u003e\nTransport: default\nSSL profile: oc\nAuthorization required: yes\n\u003c/pre\u003e\u003c/li\u003e\u003cli\u003eThe SSL profile must be configured with a trust certificate.\u003c/li\u003e\u003c/ol\u003e"
}
],
"value": "The following conditions must both be met for this vulnerability to be exploitable:\n\n1. OpenConfig gRPC transport must have an SSL profile configured with request authorization enabled:\n\n Transport: default\n SSL profile: oc\n Authorization required: yes\n\n2. The SSL profile must be configured with a trust certificate."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.\u003c/p\u003e"
}
],
"value": "On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-266",
"description": "CWE-266 Incorrect Privilege Assignment",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T08:01:20.911Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Networks Security Advisory 0163",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24719-security-advisory-0163"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix for this vulnerability:\n - 4.33.9M and later releases in the 4.33.x train\n - 4.34.8M and later releases in the 4.34.x train\n - 4.35.6M and later releases in the 4.35.x train\n - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
}
],
"source": {
"advisory": "Security Advisory 0163",
"defects": [
"BUG 1602589"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0163",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eEnsure that the privilege level 0 AAA authorization method list includes methods beyond \u003ccode\u003enone\u003c/code\u003e to prevent unintended access escalation:\u003c/p\u003e\u003cpre\u003e\naaa authorization exec default local group tacacs+\naaa authorization commands 0 default local group tacacs+\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests).\u003c/p\u003e"
}
],
"value": "Ensure that the privilege level 0 AAA authorization method list includes methods beyond \u0027none\u0027 to prevent unintended access escalation:\n\n aaa authorization exec default local group tacacs+\n aaa authorization commands 0 default local group tacacs+\n\nTo detect potential exploitation, enable AAA accounting and monitor logs for cases where a user\u0027s privilege level in gRPC requests does not match their defined privilege level (e.g., a user with privilege 9 appearing as priv-lvl=0 in gRPC requests)."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73461",
"datePublished": "2026-09-16T08:01:20.911Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-17T03:56:55.952Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73447 (GCVE-0-2026-73447)
Vulnerability from cvelistv5 – Published: 2026-09-16 06:04 – Updated: 2026-09-17 11:48
VLAI
EPSS
VEX
Title
Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request
Summary
A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 03:57 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.30.2F , < 4.31.0F
(custom)
Affected: 4.31.0F , < 4.32.0F (custom) Affected: 4.32.0F , < 4.33.0F (custom) Affected: 4.33.0F , ≤ 4.33.8M (custom) Affected: 4.34.0F , ≤ 4.34.7M (custom) Affected: 4.35.0F , ≤ 4.35.5M (custom) Affected: 4.36.0F , ≤ 4.36.0.1F (custom) |
Date Public
2026-09-09 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73447",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T03:57:00.368238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T11:48:35.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"710 Series",
"720D/XP/722XPM Series",
"750X Series",
"7010TX Series",
"7020R/R4 Series",
"7130 Series (EOS)",
"7170 Series",
"7050X3/X4 Series",
"7060X/X2/X4/X5/X6 Series",
"7260X/X3 Series",
"7280R/R2/R3/R4 Series",
"7300X/X3 Series",
"7320X Series",
"7358X4 Series",
"7368X4 Series",
"7388X5 Series",
"7500R/R2/R3 Series",
"7800R3/R4 Series",
"7700R4 Series",
"AWE 5000 Series",
"AWE 7200R Series",
"CloudEOS",
"cEOS-lab",
"vEOS-lab",
"CloudVision eXchange"
],
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"changes": [
{
"at": "4.30.2F",
"status": "affected"
}
],
"lessThan": "4.31.0F",
"status": "affected",
"version": "4.30.2F",
"versionType": "custom"
},
{
"lessThan": "4.32.0F",
"status": "affected",
"version": "4.31.0F",
"versionType": "custom"
},
{
"lessThan": "4.33.0F",
"status": "affected",
"version": "4.32.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "4.33.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0F",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.36.0.1F",
"status": "affected",
"version": "4.36.0F",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eFor the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\u003c/p\u003e\u003cpre\u003e\nswitch#show man api gnsi\nCertz enabled: yes\n\u003c/pre\u003e\u003cp\u003eFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included.\u003c/p\u003e"
}
],
"value": "For the Certz service to be exploitable, gNSI Certz must be enabled on the device. This can be verified with:\n\n switch#show man api gnsi\n Certz enabled: yes\n\nFor the Bootz service to be exploitable, Bootz must be used for initial provisioning and a CertzProfile containing X509 PEM certificates must be included."
}
],
"datePublic": "2026-09-09T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.\u003c/p\u003e"
}
],
"value": "A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"privilegesRequired": "HIGH",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T06:04:25.573Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Networks Security Advisory 0162",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe following EOS releases contain the fix for this vulnerability:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this vulnerability.\u003c/p\u003e"
}
],
"value": "The following EOS releases contain the fix for this vulnerability:\n - 4.33.9M and later releases in the 4.33.x train\n - 4.34.7.1M and later releases in the 4.34.x train\n - 4.35.6M and later releases in the 4.35.x train\n - 4.36.1F and later releases in the 4.36.x train\n\nNo hotfix is available for this vulnerability."
}
],
"source": {
"advisory": "Security Advisory 0162",
"defects": [
"BUG 1602632"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e\u003cstrong\u003eFor the Bootz service:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003eDo not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eFor the Certz service (choose one):\u003c/strong\u003e\u003c/p\u003e\u003cp\u003eOption 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\u003c/p\u003e\u003cpre\u003e\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#no service certz\n\u003c/pre\u003e\u003cp\u003eOption 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#management api gnsi\nswitch(config-mgmt-api-gnsi)#service authz\n\u003c/pre\u003e\u003cp\u003eTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\u003c/p\u003e\u003cpre\u003e\nswitch(config)#monitor security audit\nswitch(config-audit)#rule group process-creation\n-a always,exit -F arch=b64 -S execve -k process-create\n-a always,exit -F arch=b32 -S execve -k process-create\nEOF\nswitch(config-audit)#monitor group process-creation\n\u003c/pre\u003e"
}
],
"value": "For the Bootz service:\n - Do not include X509 PEM certificates in the initial CertzProfile during Bootz provisioning.\n\nFor the Certz service (choose one):\n\n Option 1: Disable gNSI Certz entirely (requires manual SSL profile management going forward):\n switch(config)#management api gnsi\n switch(config-mgmt-api-gnsi)#no service certz\n\n Option 2: Restrict Certz access using a gNSI Authz policy. Apply an authorization policy that limits the Certz Rotate RPC to only explicitly permitted users:\n switch(config)#management api gnsi\n switch(config-mgmt-api-gnsi)#service authz\n\nTo detect potential exploitation, configure auditd to monitor for suspicious child processes spawned by OpenConfig/Octa services:\n switch(config)#monitor security audit\n switch(config-audit)#rule group process-creation\n -a always,exit -F arch=b64 -S execve -k process-create\n -a always,exit -F arch=b32 -S execve -k process-create\n EOF\n switch(config-audit)#monitor group process-creation"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73447",
"datePublished": "2026-09-16T06:04:25.573Z",
"dateReserved": "2026-08-12T16:42:47.921Z",
"dateUpdated": "2026-09-17T11:48:35.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86109 (GCVE-0-2026-86109)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:57 – Updated: 2026-09-17 17:40
VLAI
EPSS
VEX
Title
Security Advisory 0182
Summary
The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-347 - Improper Verification of Cryptographic Signature
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86109",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:03.578525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:40:35.095Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eExploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package.\u003c/p\u003e"
}
],
"value": "Exploitation requires control over the software-update package or associated update metadata delivered to the Edge. This could result from compromise of the VeloCloud Orchestrator or high-privilege access sufficient to stage, replace, or control an Edge software-update package."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista. Arista is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software.\u003c/p\u003e"
}
],
"value": "The VeloCloud Edge software update workflow may accept update bundles without properly validating their signatures because the workflow does not restrict the digest algorithm used for artifact verification. An attacker with either sufficient privileges to upload packages to VeloCloud Orchestrator or credentials permitting direct access to an Edge may be able to install unauthorized software."
}
],
"impacts": [
{
"capecId": "CAPEC-206",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-206 Signing Malicious Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347: Improper Verification of Cryptographic Signature",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:57:46.285Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0182",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24738-security-advisory-0182"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0182",
"defects": [
"BUG1833886"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0182",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \u003cbr\u003e2. Protect VeloCloud Orchestrator administrative credentials and management access. \u003cbr\u003e3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \u003cbr\u003e4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow.\u003c/p\u003e"
}
],
"value": "1. Restrict software-image management and VeloCloud Edge update privileges to trusted administrators. \n2. Protect VeloCloud Orchestrator administrative credentials and management access. \n3. Obtain and distribute VeloCloud Edge software only through trusted Arista management and distribution channels. \n4. Investigate unexpected software images or update operations before permitting installation. These measures reduce exposure but do not correct the vulnerable update-verification workflow."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86109",
"datePublished": "2026-09-16T02:57:46.285Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:40:35.095Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-86108 (GCVE-0-2026-86108)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:50 – Updated: 2026-09-17 17:41
VLAI
EPSS
VEX
Title
Security Advisory 0181
Summary
Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:40 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/zh/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | VeloCloud Edge |
Affected:
6.4.0 , ≤ 6.4.1.x
(custom)
Affected: 6.1.0 , ≤ 6.1.4.x (custom) Affected: 5.2.0 , ≤ 5.2.6.x (custom) Affected: 0.0.0 , < 5.2.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-86108",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:40:53.450896Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:41:11.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "VeloCloud Edge",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "6.4.1.x",
"status": "affected",
"version": "6.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "6.1.4.x",
"status": "affected",
"version": "6.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "5.2.6.x",
"status": "affected",
"version": "5.2.0",
"versionType": "custom"
},
{
"lessThan": "5.2.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface.\u003c/p\u003e"
}
],
"value": "To successfully leverage this vulnerability, an attacker must either control a compromised VeloCloud Orchestrator or possess the credentials required to submit malicious parameters through an established management interface."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge.\u003c/p\u003e"
}
],
"value": "Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated privileges on the affected VeloCloud Edge."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:50:07.219Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0181",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/zh/support/advisories-notices/security-advisory/24737-security-advisory-0181"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eMigrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations.\u003c/p\u003e"
}
],
"value": "Migrating to a patched software version for VeloCloud Edge is the advised course of action. Arista suggests that operators transition to the most recent release within a supported branch that incorporates the necessary remediations."
}
],
"source": {
"advisory": "0181",
"defects": [
"BUG1857467",
"BUG1833895",
"BUG1833902",
"BUG1833887"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0181",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003e1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \u003cbr\u003e2. Protect Orchestrator administrative credentials and management access. \u003cbr\u003e3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel.\u003c/p\u003e"
}
],
"value": "1. Restrict VeloCloud Orchestrator Super Admin and Operator roles, particularly Remote Diagnostics and device-configuration access, to trusted personnel. \n2. Protect Orchestrator administrative credentials and management access. \n3. Maintain the default Local UI access restrictions and limit activation access to authorized personnel."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-86108",
"datePublished": "2026-09-16T02:50:07.219Z",
"dateReserved": "2026-09-05T01:54:43.258Z",
"dateUpdated": "2026-09-17T17:41:11.191Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73450 (GCVE-0-2026-73450)
Vulnerability from cvelistv5 – Published: 2026-09-16 02:32 – Updated: 2026-09-17 17:41
VLAI
EPSS
VEX
Title
Security Advisory 0161
Summary
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-17 17:41 UTC
CWE
- CWE-345 - Insufficient Verification of Data Authenticity
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 4.33.0 , ≤ 4.33.9M (custom) Affected: 0.0.0 , < 4.33.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73450",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-17T17:41:23.594863Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-17T17:41:33.537Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "4.33.0",
"versionType": "custom"
},
{
"lessThan": "4.33.0",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73450, all of the following conditions must be met:\u003cbr\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003e\u003cspan\u003eMLAG must be configured\u003c/span\u003e\u003c/li\u003e\u003cli\u003edomain-id and peer-link are active\u003c/li\u003e\u003cli\u003eUDP heartbeat peer address must be configured\u003c/li\u003e\u003cli\u003edual-primary detection must be configured with action errdisable all-interfaces\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e\u003cp\u003eBoth peers must have this configuration applied to be vulnerable.\u003c/p\u003e\u003cp\u003eExample vulnerable configuration:\u003c/p\u003e\u003cpre\u003eswitch(config)# mlag\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlagDomain\nswitch(config-mlag)# peer-address heartbeat 172.30.118.190\nswitch(config-mlag)# dual-primary detection delay 5 action errdisable all-interfaces\u003c/pre\u003e\u003cp\u003eExample show command output for vulnerable configuration:\u003c/p\u003e\u003cpre\u003eswitch# show mlag\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\nMLAG Configuration:\ndomain-id \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; mlagDomain\nlocal-interface \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Vlan4094\npeer-address\u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 10.0.0.2\npeer-link \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; Port-Channel10\nhb-peer-address \u0026nbsp; : \u0026nbsp; \u0026nbsp; 172.30.118.190\n \nMLAG Status:\nstate \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Active\n\u2026\u0026nbsp;\nMLAG ports:\n\u2026\n \nMLAG Detailed Status:\n\u2026\nDual-primary detection delay \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 5\nDual-primary action\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; :\u0026nbsp; \u0026nbsp; \u0026nbsp; errdisable-all\nDual-primary recovery delay\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\nDual-primary non-mlag recovery delay : \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 0\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73450, all of the following conditions must be met:\n\n\n * MLAG must be configured\n * domain-id and peer-link are active\n * UDP heartbeat peer address must be configured\n * dual-primary detection must be configured with action errdisable all-interfaces\n\n\n\n\n\n\nBoth peers must have this configuration applied to be vulnerable.\n\n\n\nExample vulnerable configuration:\n\n\n\nswitch(config)# mlag\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlagDomain\nswitch(config-mlag)# peer-address heartbeat 172.30.118.190\nswitch(config-mlag)# dual-primary detection delay 5 action errdisable all-interfaces\n\n\n\nExample show command output for vulnerable configuration:\n\n\n\nswitch# show mlag\u00a0\u00a0\u00a0\u00a0\nMLAG Configuration:\ndomain-id \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 mlagDomain\nlocal-interface \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Vlan4094\npeer-address\u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 10.0.0.2\npeer-link \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 Port-Channel10\nhb-peer-address \u00a0 : \u00a0 \u00a0 172.30.118.190\n \nMLAG Status:\nstate \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Active\n\u2026\u00a0\nMLAG ports:\n\u2026\n \nMLAG Detailed Status:\n\u2026\nDual-primary detection delay \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 5\nDual-primary action\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 :\u00a0 \u00a0 \u00a0 errdisable-all\nDual-primary recovery delay\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0\nDual-primary non-mlag recovery delay : \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 0"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption."
}
],
"impacts": [
{
"capecId": "CAPEC-141",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-141 Message Spoofing"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-345",
"description": "CWE-345: Insufficient Verification of Data Authenticity",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T02:32:45.999Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0161",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24717-security-advisory-0161"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience."
}
],
"source": {
"advisory": "0161",
"defects": [
"BUG1852792"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0161",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eRestrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to permit traffic strictly from the designated peer address.\u003c/p\u003e\u003cp\u003eInsert the following ACL rules into the top of the ingress ACL on the VRF where the heartbeat address is configured, while denying traffic from all other source addresses.\u003c/p\u003e\u003cpre\u003epermit udp host \u0026lt;heartbeatPeerAddress\u0026gt; any eq mlag\npermit udp any any eq mlag ttl eq 255\ndeny udp any any eq mlag log\u003c/pre\u003e\u003cp\u003eEnsure administrative access for required services (e.g., SSH, NTP, SNMP) remains permitted.\u003c/p\u003e\u003cp\u003eFor instance, if the heartbeat address is reachable via the management VRF. First, construct the ingress ACL to restrict access on the MLAG heartbeat interface.\u003c/p\u003e\u003cpre\u003eswitch(config)#ip access-list MLAG-HEARTBEAT-PROTECT\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#5 permit udp host 172.30.118.190 any eq mlag\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#6 permit udp any any eq mlag ttl eq 255\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#7 deny udp any any eq mlag log\n...\u003c/pre\u003e\u003cp\u003eApply the ACL to management VRF:\u003c/p\u003e\u003cpre\u003eswitch(config)#system control-plane\nswitch(config-system-cp)#ip access-group MLAG-HEARTBEAT-PROTECT vrf management in\nswitch(config-system-cp)#exit\u003c/pre\u003e\u003cp\u003eShow command to confirm the rules:\u003c/p\u003e\u003cpre\u003eswitch(config)#show ip access-lists MLAG-HEARTBEAT-PROTECT\nPhone ACL bypass: disabled\nIP Access List MLAG-HEARTBEAT-PROTECT\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;5 permit udp host 172.30.118.190 any eq mlag\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;6 permit udp any any eq mlag ttl eq 255\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;7 deny udp any any eq mlag log\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u2026\n \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Total rules configured: \u2026\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Configured on Ingress: control-plane(management VRF)\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Active on \u0026nbsp; \u0026nbsp; Ingress: control-plane(management VRF)\u003c/pre\u003e"
}
],
"value": "Restrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to permit traffic strictly from the designated peer address.\n\n\n\nInsert the following ACL rules into the top of the ingress ACL on the VRF where the heartbeat address is configured, while denying traffic from all other source addresses.\n\n\n\npermit udp host \u003cheartbeatPeerAddress\u003e any eq mlag\npermit udp any any eq mlag ttl eq 255\ndeny udp any any eq mlag log\n\n\n\nEnsure administrative access for required services (e.g., SSH, NTP, SNMP) remains permitted.\n\n\n\nFor instance, if the heartbeat address is reachable via the management VRF. First, construct the ingress ACL to restrict access on the MLAG heartbeat interface.\n\n\n\nswitch(config)#ip access-list MLAG-HEARTBEAT-PROTECT\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#5 permit udp host 172.30.118.190 any eq mlag\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#6 permit udp any any eq mlag ttl eq 255\nswitch(config-acl-MLAG-HEARTBEAT-PROTECT)#7 deny udp any any eq mlag log\n...\n\n\n\nApply the ACL to management VRF:\n\n\n\nswitch(config)#system control-plane\nswitch(config-system-cp)#ip access-group MLAG-HEARTBEAT-PROTECT vrf management in\nswitch(config-system-cp)#exit\n\n\n\nShow command to confirm the rules:\n\n\n\nswitch(config)#show ip access-lists MLAG-HEARTBEAT-PROTECT\nPhone ACL bypass: disabled\nIP Access List MLAG-HEARTBEAT-PROTECT\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a05 permit udp host 172.30.118.190 any eq mlag\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a06 permit udp any any eq mlag ttl eq 255\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a07 deny udp any any eq mlag log\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u2026\n \n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Total rules configured: \u2026\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Configured on Ingress: control-plane(management VRF)\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Active on \u00a0 \u00a0 Ingress: control-plane(management VRF)"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73450",
"datePublished": "2026-09-16T02:32:45.999Z",
"dateReserved": "2026-08-12T16:42:47.921Z",
"dateUpdated": "2026-09-17T17:41:33.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73460 (GCVE-0-2026-73460)
Vulnerability from cvelistv5 – Published: 2026-09-15 23:20 – Updated: 2026-09-16 19:35
VLAI
EPSS
VEX
Title
Security Advisory 0160
Summary
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:35 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73460",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:35:29.181267Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:35:40.181Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73460, the following condition must be met: IS-IS graceful-restart should be enabled.\u003c/p\u003e\u003cpre\u003eswitch(config-router-isis)#show active\nrouter isis 1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;net 49.0001.1111.1111.1001.00\n\u0026nbsp;\u0026nbsp;\u0026nbsp;graceful-restart\u003cbr\u003e\u003cbr\u003e\u003cpre\u003eswitch#show isis graceful-restart\nIS-IS Instance: 1 VRF: default\n\u0026nbsp;\u0026nbsp;System ID: 1111.1111.1001\n\u0026nbsp;\u0026nbsp;Graceful Restart: Enabled, Graceful Restart Helper: Enabled\n\u0026nbsp;\u0026nbsp;State: Graceful Restart disabled during startup\n\u0026nbsp;\u0026nbsp;T1 : 3s\n\u0026nbsp;\u0026nbsp;T2 (level-1) : 30s/not running\n\u0026nbsp;\u0026nbsp;T2 (level-2) : 30s/not running\n\u0026nbsp;\u0026nbsp;T3 : not running\n\u0026nbsp;\u0026nbsp;System ID\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Type\u0026nbsp; \u0026nbsp; Interface\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Restart Capable \u0026nbsp; Status\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\n\u0026nbsp;\u0026nbsp;1111.1111.1002 \u0026nbsp; \u0026nbsp; L1\u0026nbsp; \u0026nbsp; \u0026nbsp; Ethernet1\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Yes \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Running\u0026nbsp; \u003c/pre\u003e\u003c/pre\u003e\u003cp\u003eIf IS-IS graceful-restart is not enabled, there is no exposure to this issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73460, the following condition must be met: IS-IS graceful-restart should be enabled.\n\n\n\nswitch(config-router-isis)#show active\nrouter isis 1\n\u00a0\u00a0\u00a0net 49.0001.1111.1111.1001.00\n\u00a0\u00a0\u00a0graceful-restart\n\n\n\nswitch#show isis graceful-restart\nIS-IS Instance: 1 VRF: default\n\u00a0\u00a0System ID: 1111.1111.1001\n\u00a0\u00a0Graceful Restart: Enabled, Graceful Restart Helper: Enabled\n\u00a0\u00a0State: Graceful Restart disabled during startup\n\u00a0\u00a0T1 : 3s\n\u00a0\u00a0T2 (level-1) : 30s/not running\n\u00a0\u00a0T2 (level-2) : 30s/not running\n\u00a0\u00a0T3 : not running\n\u00a0\u00a0System ID\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Type\u00a0 \u00a0 Interface\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Restart Capable \u00a0 Status\u00a0\u00a0\u00a0\u00a0\n\u00a0\u00a01111.1111.1002 \u00a0 \u00a0 L1\u00a0 \u00a0 \u00a0 Ethernet1\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Yes \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Running\u00a0 \n\n\n\n\n\nIf IS-IS graceful-restart is not enabled, there is no exposure to this issue."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista and the company is not aware of any malicious uses of these issues in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event."
}
],
"impacts": [
{
"capecId": "CAPEC-272",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-272 Protocol Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863: Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T23:20:43.813Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0160",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed software version.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed software version."
}
],
"source": {
"advisory": "0160",
"defects": [
"BUG1840562"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0160",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo workaround is available for this issue.\u003c/p\u003e"
}
],
"value": "No workaround is available for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73460",
"datePublished": "2026-09-15T23:20:43.813Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-16T19:35:40.181Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-73459 (GCVE-0-2026-73459)
Vulnerability from cvelistv5 – Published: 2026-09-15 23:16 – Updated: 2026-09-16 19:34
VLAI
EPSS
VEX
Title
Security Advisory 0160
Summary
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 19:34 UTC
CWE
- CWE-354 - Improper Validation of Integrity Check Value
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73459",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T19:34:28.975379Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T19:34:44.583Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73459, the following condition must be met: \u003cbr\u003e\u003cbr\u003eIS-IS should be configured.\u003c/p\u003e\u003cpre\u003eswitch# show isis summary\nIS-IS Instance: 1 VRF: default\n\u0026nbsp;\u0026nbsp;Instance ID: 0\n\u0026nbsp;\u0026nbsp;System ID: 1111.1111.1001, administratively enabled\n\u0026nbsp;\u0026nbsp;Router ID: IPv4: 0.0.0.0\n\u0026nbsp;\u0026nbsp;Multi Topology disabled, not attached\n\u0026nbsp;\u0026nbsp;IPv4 Preference: Level 1: 115, Level 2: 115\n\u0026nbsp;\u0026nbsp;IPv6 Preference: Level 1: 115, Level 2: 115\n\u0026nbsp;\u0026nbsp;IS-Type: Level 1 and 2, Number active interfaces: 1\n\u0026nbsp;\u0026nbsp;Routes both IPv4 and IPv6\n\u0026nbsp;\u0026nbsp;LSP size maximum: Level 1: 1492, Level 2: 1492\n\u0026nbsp;\u0026nbsp;Interval Type \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Max Wait Initial Wait Hold Interval\n\u0026nbsp;\u0026nbsp;----------------------- -------- ------------ -------------\n\u0026nbsp;\u0026nbsp;LSP generation interval\u0026nbsp; \u0026nbsp; \u0026nbsp; 5 s\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 ms\n\u0026nbsp;\u0026nbsp;SPF interval\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 30000 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; 300 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 80 ms\n\u0026nbsp;\u0026nbsp;Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n\u0026nbsp;\u0026nbsp;Last Level 1 SPF run 9 seconds ago\n\u0026nbsp;\u0026nbsp;Last Level 2 SPF run 9 seconds ago\n\u0026nbsp;\u0026nbsp;CSNP generation interval: 10 seconds\n\u0026nbsp;\u0026nbsp;Dynamic Flooding: Disabled\n\u0026nbsp;\u0026nbsp;Authentication mode: Level 1: None, Level 2: None\n\u0026nbsp;\u0026nbsp;Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n\u0026nbsp;\u0026nbsp;Area addresses: 40\n\u0026nbsp;\u0026nbsp;level 1: number DIS interfaces: 0, LSDB size: 1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Area Leader: None\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Overload Bit is not set.\u0026nbsp;\n\u0026nbsp;\u0026nbsp;level 2: number DIS interfaces: 0, LSDB size: 1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Area Leader: None\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Overload Bit is not set.\u0026nbsp;\n\u0026nbsp;\u0026nbsp;Redistributed Level 1 routes: 0 limit: Not Configured\n\u0026nbsp;\u0026nbsp;Redistributed Level 2 routes: 0 limit: Not Configured\u003c/pre\u003e\u003cp\u003eIf IS-IS is not configured, there is no exposure to this issue.\u003cbr\u003e\u003c/p\u003e\u003cpre\u003eswitch#show isis summary\nswitch#\u0026nbsp;\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73459, the following condition must be met: \n\nIS-IS should be configured.\n\n\n\nswitch# show isis summary\nIS-IS Instance: 1 VRF: default\n\u00a0\u00a0Instance ID: 0\n\u00a0\u00a0System ID: 1111.1111.1001, administratively enabled\n\u00a0\u00a0Router ID: IPv4: 0.0.0.0\n\u00a0\u00a0Multi Topology disabled, not attached\n\u00a0\u00a0IPv4 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IPv6 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IS-Type: Level 1 and 2, Number active interfaces: 1\n\u00a0\u00a0Routes both IPv4 and IPv6\n\u00a0\u00a0LSP size maximum: Level 1: 1492, Level 2: 1492\n\u00a0\u00a0Interval Type \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Max Wait Initial Wait Hold Interval\n\u00a0\u00a0----------------------- -------- ------------ -------------\n\u00a0\u00a0LSP generation interval\u00a0 \u00a0 \u00a0 5 s\u00a0 \u00a0 \u00a0 \u00a0 50 ms \u00a0 \u00a0 \u00a0 \u00a0 50 ms\n\u00a0\u00a0SPF interval\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 30000 ms \u00a0 \u00a0 \u00a0 300 ms \u00a0 \u00a0 \u00a0 \u00a0 80 ms\n\u00a0\u00a0Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n\u00a0\u00a0Last Level 1 SPF run 9 seconds ago\n\u00a0\u00a0Last Level 2 SPF run 9 seconds ago\n\u00a0\u00a0CSNP generation interval: 10 seconds\n\u00a0\u00a0Dynamic Flooding: Disabled\n\u00a0\u00a0Authentication mode: Level 1: None, Level 2: None\n\u00a0\u00a0Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n\u00a0\u00a0Area addresses: 40\n\u00a0\u00a0level 1: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0level 2: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0Redistributed Level 1 routes: 0 limit: Not Configured\n\u00a0\u00a0Redistributed Level 2 routes: 0 limit: Not Configured\n\n\n\nIf IS-IS is not configured, there is no exposure to this issue.\n\n\n\n\nswitch#show isis summary\nswitch#"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered internally by Arista and the company is not aware of any malicious uses of these issues in customer networks."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.\u003c/p\u003e"
}
],
"value": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss."
}
],
"impacts": [
{
"capecId": "CAPEC-272",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-272 Protocol Manipulation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-354",
"description": "CWE-354: Improper Validation of Integrity Check Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T23:16:27.270Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Security Advisory 0160",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed software version.\u003c/p\u003e"
}
],
"value": "The recommended resolution is to upgrade to a fixed software version."
}
],
"source": {
"advisory": "0160",
"defects": [
"BUG1840507"
],
"discovery": "UNKNOWN"
},
"title": "Security Advisory 0160",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo workaround is available for this issue.\u003c/p\u003e"
}
],
"value": "No workaround is available for this issue."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73459",
"datePublished": "2026-09-15T23:16:27.270Z",
"dateReserved": "2026-08-12T16:45:03.511Z",
"dateUpdated": "2026-09-16T19:34:44.583Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}