Vulnerability-Lookup

CVE-2026-73459 (GCVE-0-2026-73459)

Vulnerability from cvelistv5 – Published: 2026-09-15 23:16 – Updated: 2026-09-15 23:16

Title

Security Advisory 0160

Summary

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

Severity

7.4 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

7 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

CWE

CWE-354 - Improper Validation of Integrity Check Value

Assigner

Arista mitre root

References

1 reference

URL	Tags
https://www.arista.com/en/support/advisories-noti…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
Arista Networks	EOS	Affected: 4.36.0 , ≤ 4.36.1F (custom)	guessed

Credits

This issue was discovered internally by Arista and the company is not aware of any malicious uses of these issues in customer networks.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73459, the following condition must be met: \u003cbr\u003e\u003cbr\u003eIS-IS should be configured.\u003c/p\u003e\u003cpre\u003eswitch# show isis summary\nIS-IS Instance: 1 VRF: default\n\u0026nbsp;\u0026nbsp;Instance ID: 0\n\u0026nbsp;\u0026nbsp;System ID: 1111.1111.1001, administratively enabled\n\u0026nbsp;\u0026nbsp;Router ID: IPv4: 0.0.0.0\n\u0026nbsp;\u0026nbsp;Multi Topology disabled, not attached\n\u0026nbsp;\u0026nbsp;IPv4 Preference: Level 1: 115, Level 2: 115\n\u0026nbsp;\u0026nbsp;IPv6 Preference: Level 1: 115, Level 2: 115\n\u0026nbsp;\u0026nbsp;IS-Type: Level 1 and 2, Number active interfaces: 1\n\u0026nbsp;\u0026nbsp;Routes both IPv4 and IPv6\n\u0026nbsp;\u0026nbsp;LSP size maximum: Level 1: 1492, Level 2: 1492\n\u0026nbsp;\u0026nbsp;Interval Type \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; Max Wait Initial Wait Hold Interval\n\u0026nbsp;\u0026nbsp;----------------------- -------- ------------ -------------\n\u0026nbsp;\u0026nbsp;LSP generation interval\u0026nbsp; \u0026nbsp; \u0026nbsp; 5 s\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 50 ms\n\u0026nbsp;\u0026nbsp;SPF interval\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 30000 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; 300 ms \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; 80 ms\n\u0026nbsp;\u0026nbsp;Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n\u0026nbsp;\u0026nbsp;Last Level 1 SPF run 9 seconds ago\n\u0026nbsp;\u0026nbsp;Last Level 2 SPF run 9 seconds ago\n\u0026nbsp;\u0026nbsp;CSNP generation interval: 10 seconds\n\u0026nbsp;\u0026nbsp;Dynamic Flooding: Disabled\n\u0026nbsp;\u0026nbsp;Authentication mode: Level 1: None, Level 2: None\n\u0026nbsp;\u0026nbsp;Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n\u0026nbsp;\u0026nbsp;Area addresses: 40\n\u0026nbsp;\u0026nbsp;level 1: number DIS interfaces: 0, LSDB size: 1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Area Leader: None\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Overload Bit is not set.\u0026nbsp;\n\u0026nbsp;\u0026nbsp;level 2: number DIS interfaces: 0, LSDB size: 1\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Area Leader: None\n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;Overload Bit is not set.\u0026nbsp;\n\u0026nbsp;\u0026nbsp;Redistributed Level 1 routes: 0 limit: Not Configured\n\u0026nbsp;\u0026nbsp;Redistributed Level 2 routes: 0 limit: Not Configured\u003c/pre\u003e\u003cp\u003eIf IS-IS is not configured, there is no exposure to this issue.\u003cbr\u003e\u003c/p\u003e\u003cpre\u003eswitch#show isis summary\nswitch#\u0026nbsp;\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2026-73459, the following condition must be met: \n\nIS-IS should be configured.\n\n\n\nswitch# show isis summary\nIS-IS Instance: 1 VRF: default\n\u00a0\u00a0Instance ID: 0\n\u00a0\u00a0System ID: 1111.1111.1001, administratively enabled\n\u00a0\u00a0Router ID: IPv4: 0.0.0.0\n\u00a0\u00a0Multi Topology disabled, not attached\n\u00a0\u00a0IPv4 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IPv6 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IS-Type: Level 1 and 2, Number active interfaces: 1\n\u00a0\u00a0Routes both IPv4 and IPv6\n\u00a0\u00a0LSP size maximum: Level 1: 1492, Level 2: 1492\n\u00a0\u00a0Interval Type \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Max Wait Initial Wait Hold Interval\n\u00a0\u00a0----------------------- -------- ------------ -------------\n\u00a0\u00a0LSP generation interval\u00a0 \u00a0 \u00a0 5 s\u00a0 \u00a0 \u00a0 \u00a0 50 ms \u00a0 \u00a0 \u00a0 \u00a0 50 ms\n\u00a0\u00a0SPF interval\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 30000 ms \u00a0 \u00a0 \u00a0 300 ms \u00a0 \u00a0 \u00a0 \u00a0 80 ms\n\u00a0\u00a0Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n\u00a0\u00a0Last Level 1 SPF run 9 seconds ago\n\u00a0\u00a0Last Level 2 SPF run 9 seconds ago\n\u00a0\u00a0CSNP generation interval: 10 seconds\n\u00a0\u00a0Dynamic Flooding: Disabled\n\u00a0\u00a0Authentication mode: Level 1: None, Level 2: None\n\u00a0\u00a0Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n\u00a0\u00a0Area addresses: 40\n\u00a0\u00a0level 1: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0level 2: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0Redistributed Level 1 routes: 0 limit: Not Configured\n\u00a0\u00a0Redistributed Level 2 routes: 0 limit: Not Configured\n\n\n\nIf IS-IS is not configured, there is no exposure to this issue.\n\n\n\n\nswitch#show isis summary\nswitch#"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered internally by Arista and the company is not aware of any malicious uses of these issues in customer networks."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-272",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-272 Protocol Manipulation"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-354",
              "description": "CWE-354: Improper Validation of Integrity Check Value",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T23:16:27.270Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Security Advisory 0160",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a fixed software version.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a fixed software version."
        }
      ],
      "source": {
        "advisory": "0160",
        "defects": [
          "BUG1840507"
        ],
        "discovery": "UNKNOWN"
      },
      "title": "Security Advisory 0160",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo workaround is available for this issue.\u003c/p\u003e"
            }
          ],
          "value": "No workaround is available for this issue."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73459",
    "datePublished": "2026-09-15T23:16:27.270Z",
    "dateReserved": "2026-08-12T16:45:03.511Z",
    "dateUpdated": "2026-09-15T23:16:27.270Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-73459\",\"sourceIdentifier\":\"psirt@arista.com\",\"published\":\"2026-09-16T00:17:05.213\",\"lastModified\":\"2026-09-16T00:17:05.213\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.\"}],\"affected\":[{\"source\":\"psirt@arista.com\",\"affectedData\":[{\"vendor\":\"Arista Networks\",\"product\":\"EOS\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"4.36.0\",\"lessThanOrEqual\":\"4.36.1F\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"HIGH\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"HIGH\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H\",\"baseScore\":7.4,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":4.0}]},\"weaknesses\":[{\"source\":\"psirt@arista.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-354\"}]}],\"references\":[{\"url\":\"https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160\",\"source\":\"psirt@arista.com\"}]}}"
  }
}

FKIE_CVE-2026-73459

Vulnerability from fkie_nvd - Published: 2026-09-16 00:17 - Updated: 2026-09-16 00:17

Severity

7.4 (High) - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Summary

References

	URL	Tags
	psirt@arista.com	https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "psirt@arista.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss."
    }
  ],
  "id": "CVE-2026-73459",
  "lastModified": "2026-09-16T00:17:05.213",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 4.0,
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "HIGH",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "psirt@arista.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T00:17:05.213",
  "references": [
    {
      "source": "psirt@arista.com",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"
    }
  ],
  "sourceIdentifier": "psirt@arista.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-354"
        }
      ],
      "source": "psirt@arista.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VQ63-CFF6-37Q2

Vulnerability from github – Published: 2026-09-16 00:31 – Updated: 2026-09-16 00:31

Details

Severity

7.4 (High)


                  
                    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

7.0 (High)


                  
                    CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-73459"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-354"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-16T00:17:05Z",
    "severity": "HIGH"
  },
  "details": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.",
  "id": "GHSA-vq63-cff6-37q2",
  "modified": "2026-09-16T00:31:34Z",
  "published": "2026-09-16T00:31:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73459"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-73459 (GCVE-0-2026-73459)

FKIE_CVE-2026-73459

GHSA-VQ63-CFF6-37Q2

Tags

Sightings

Nomenclature