CVE-2026-73466: CWE-532 Insertion of Sensitive Information into Log File in Arista Networks EOS
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
AI Analysis
Technical Summary
On affected Arista EOS platforms, under certain conditions involving specialized non-standard debugging trace levels explicitly enabled, user passwords may be written in clear text to log files. Exploitation requires an attacker to have authenticated local administrative shell access and the debug trace levels enabled. This vulnerability was discovered internally by Arista Networks, and no known exploitation in the wild has been reported. The affected versions include EOS versions from 0 up to and including 4.36.1F, with specific version ranges detailed in the affectedVersions field.
Potential Impact
If exploited, this vulnerability could lead to exposure of user passwords in clear text within log files, compromising confidentiality. However, exploitation requires already having authenticated local administrative access and enabling specialized debug trace levels, which limits the attack surface. There are no reports of active exploitation in customer environments.
Mitigation Recommendations
No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling specialized non-standard debugging trace levels unless necessary and restrict administrative shell access to trusted personnel only.
CVE-2026-73466: CWE-532 Insertion of Sensitive Information into Log File in Arista Networks EOS
Description
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
CVSS v3.1
Score 6.3medium
Affected software
Arista Networks
EOS
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
On affected Arista EOS platforms, under certain conditions involving specialized non-standard debugging trace levels explicitly enabled, user passwords may be written in clear text to log files. Exploitation requires an attacker to have authenticated local administrative shell access and the debug trace levels enabled. This vulnerability was discovered internally by Arista Networks, and no known exploitation in the wild has been reported. The affected versions include EOS versions from 0 up to and including 4.36.1F, with specific version ranges detailed in the affectedVersions field.
Potential Impact
If exploited, this vulnerability could lead to exposure of user passwords in clear text within log files, compromising confidentiality. However, exploitation requires already having authenticated local administrative access and enabling specialized debug trace levels, which limits the attack surface. There are no reports of active exploitation in customer environments.
Mitigation Recommendations
No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid enabling specialized non-standard debugging trace levels unless necessary and restrict administrative shell access to trusted personnel only.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Arista
- Date Reserved
- 2026-08-12T16:47:18.121Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa992be55bf5e2cf53bf4cf
Added to database: 09/15/2026, 18:47:26 UTC
Last enriched: 09/15/2026, 19:47:21 UTC
Last updated: 09/16/2026, 00:36:47 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.