CVE-2026-73456 is a critical vulnerability in Arista Networks EOS affecting versions 4.34.2F through 4.34.7M, 4.35.0 through 4.35.5M, and 4.36.0 through 4.36.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Packet Sampling Interface (gNPSI). An unauthenticated attacker can exploit this flaw to execute arbitrary code, gaining full administrative control over the affected switch.
CVE-2026-73443 is an authentication bypass vulnerability in Arista Networks EOS affecting VRRPv2 IP-AH authentication. An unauthenticated attacker on the same layer 2 network segment can capture and replay legitimate VRRP advertisements indefinitely. This replay can cause stale VRRP state to be advertised, preventing backup routers from taking over the virtual gateway after the master router fails, resulting in denial of service for hosts relying on the virtual gateway.
On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
CVE-2026-73464 is a high-severity vulnerability in Arista Networks EOS affecting versions from 4.29.0F up to and including 4.36.0.1F. It involves improper control of code generation (CWE-94) in the gRPC Network Management Interface (gNMI). An authenticated client with gNMI access could send a specially crafted request to execute arbitrary code with root privileges on the switch.
CVE-2026-73439 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.33.2F through 4.33.8M, 4.34.0F through 4.34.6M, 4.35.0F through 4.35.5M, and 4.36.0F through 4.36.0.1F. It occurs when OpenConfig is configured with a gNMI server and a gNSI Pathz policy containing both group and user rules for the same path. Under these conditions, gNMI may fail to enforce the Pathz policy correctly, allowing an authenticated user to gain unauthorized read or write permissions on restricted gNMI paths. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality, integrity, and availability. No information about patches or vendor advisories is provided, so patch status is not confirmed.
CVE-2026-73460 is an incorrect authorization vulnerability in Arista Networks EOS affecting versions 4.36.0 through 4.36.1F. It occurs when IS-IS graceful restart is enabled, allowing an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet to prematurely terminate the IS-IS graceful restart procedure. This can lead to traffic loss after a restart event. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-73459 is a high-severity vulnerability in Arista Networks EOS affecting versions 4.36.0 through 4.36.1F. It involves improper validation of integrity check values in the IS-IS protocol implementation. An unauthenticated attacker able to inject specially crafted IS-IS LSP PDUs can cause legitimate LSPs to be purged unexpectedly from the IS-IS link-state database, potentially resulting in traffic loss.
CVE-2026-73444 is a vulnerability in Arista Networks EOS affecting VRRPv2 IP Authentication Header (IP-AH) authentication. An unauthenticated attacker with access to the layer 2 network segment running VRRP can bypass authentication and assume the virtual router master role. This allows the attacker to intercept, modify, or discard traffic sent to the virtual gateway address. The vulnerability affects specific versions of EOS prior to fixed releases. The CVSS score is 4.7, indicating medium severity with a focus on availability impact.
On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).
On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled.
To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
CVE-2026-75945 is a low-severity vulnerability in Arista Networks EOS where a race condition may cause a supplicant to remain authorized after the 'clear dot1x host all' command is issued. This incomplete cleanup issue could lead to a supplicant retaining an authorized state unexpectedly.