On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability.
Examples of sensitive information include:
- Sensitive CLI commands (e.g., "username bob secret myPass")
- Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key")
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
CVE-2026-73464 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Management Interface (gNMI). An authenticated client with gNMI access could send a specially crafted request to execute arbitrary code with root privileges on the switch.
CVE-2026-73454 is a command injection vulnerability in Arista Networks EOS affecting platforms with gRPC Network Security Interface (gNSI) Credentialz configured. A specially crafted request can cause unintended changes to account properties, potentially granting elevated privileges beyond intended administrative controls. The vulnerability is rated high severity with a CVSS score of 8.1. Multiple versions of EOS from 4.30.0F through 4.36.0.1F are affected. No explicit patch information is provided in the input data.
CVE-2026-73439 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.33.2F through 4.33.8M, 4.34.0F through 4.34.6M, 4.35.0F through 4.35.5M, and 4.36.0F through 4.36.0.1F. It occurs when OpenConfig is configured with a gNMI server and a gNSI Pathz policy containing both group and user rules for the same path. Under these conditions, gNMI may fail to enforce the Pathz policy correctly, allowing an authenticated user to gain unauthorized read or write permissions on restricted gNMI paths. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality, integrity, and availability. No information about patches or vendor advisories is provided, so patch status is not confirmed.
CVE-2026-73461 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves incorrect privilege assignment in AAA-based gRPC authorization for OpenConfig, where authenticated users may receive incorrect privilege levels, causing authorization with the wrong AAA method list. This issue does not affect non-gRPC OpenConfig requests such as NETCONF.
CVE-2026-73447 is a critical OS command injection vulnerability in Arista Networks EOS. It allows an authenticated privileged user to execute arbitrary commands with root privileges via the gRPC Network Security Interface (gNSI) Certz service and the Bootz service. Successful exploitation leads to full device compromise.
CVE-2026-86109 is a vulnerability in Arista Networks VeloCloud Edge where the software update workflow does not properly verify cryptographic signatures. This occurs because the update process does not restrict the digest algorithm used for verifying update bundles. An attacker with sufficient privileges to upload packages or access the Edge device could install unauthorized software. The vulnerability affects multiple versions of VeloCloud Edge up to 6.4.1.x. The CVSS score is 6.6, indicating a medium severity level.
CVE-2026-86108 is an OS command injection vulnerability in Arista Networks VeloCloud Edge. It arises from insufficient input validation in management and configuration workflows, allowing authorized management requests or configuration values to be interpreted as OS commands. Successful exploitation can lead to command execution with elevated privileges on the affected device. The vulnerability affects multiple versions of VeloCloud Edge from before 5.2.0 up to 6.4.1.x. It has a high severity with a CVSS score of 8. No known exploits are reported in the wild, and no patch information is provided.
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.
CVE-2026-73460 is an incorrect authorization vulnerability in Arista Networks EOS affecting versions 4.36.0 through 4.36.1F. It occurs when IS-IS graceful restart is enabled, allowing an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet to prematurely terminate the IS-IS graceful restart procedure. This can lead to traffic loss after a restart event. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-73459 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.36.0 through 4.36.1F. It involves improper validation of integrity check values in the IS-IS protocol implementation. An unauthenticated attacker able to inject specially crafted IS-IS LSP PDUs can cause legitimate LSPs to be purged unexpectedly from the IS-IS link-state database, potentially resulting in traffic loss.
A vulnerability in Arista Networks EOS allows an unauthenticated attacker to disrupt IS-IS adjacencies by sending crafted IS-IS Hello PDUs on broadcast interfaces. This can cause traffic disruption and loss of IP reachability for prefixes advertised through the affected adjacency. The issue affects multiple versions of EOS from 4.31.0 through 4.36.1F. The vulnerability has a high severity rating with a CVSS score of 7.4.
CVE-2026-73444 is a vulnerability in Arista Networks EOS affecting VRRPv2 IP Authentication Header (IP-AH) authentication. An unauthenticated attacker with access to the layer 2 network segment running VRRP can bypass authentication and assume the virtual router master role. This allows the attacker to intercept, modify, or discard traffic sent to the virtual gateway address. The vulnerability affects specific versions of EOS prior to fixed releases. The CVSS score is 4.7, indicating medium severity with a focus on availability impact.
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.
CVE-2026-19655 is a medium severity vulnerability in Arista Networks EOS affecting versions 4.33.0 through before 4.33.10M, 4.34.0 through before 4.34.8M, and 4.35.0 through before 4.35.6M. It involves improper input validation in the DHCP relay/snooping feature when configured with the information option (Option 82). An unauthenticated attacker on a client-facing VLAN where DHCP relay is configured can send a crafted packet that causes the DHCP Relay service to restart, resulting in denial of service.