CVE-2026-73463

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

CVE-2026-73445

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-2380

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-73464

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

CVE-2026-73454

On affected platforms running Arista EOS with gRPC Network Security Interface gNSI Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an...

CVE-2026-73439

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule fo...

CVE-2026-73447

CVE-2026-73447 is a CRITICAL (CVSS 3.1: 9.1) OS command injection (CWE-78) in the gNSI Certz and Bootz services on Arista EOS . An authenticated user can escalate privileges to root via a crafted Certz Rotate request, leading to full device compromise . Affected versions span the 4.30.x through 4...

CVE-2026-73450

On affected Arista EOS platforms with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the heartbeat network segment can send crafted UDP packets to corrupt the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary sw...

EUVD-2026-80083

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these...

EUVD-2026-80066

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event...

EUVD-2026-80064

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit PDU that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP...

EUVD-2026-80065

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss...

EUVD-2026-80007

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol DHCP relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to...

EUVD-2026-80009

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header IP-AH authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the...

CVE-2026-73460

CVE-2026-73460 affects Arista EOS running with IS-IS graceful restart enabled. An unauthenticated attacker in the same Layer 2 domain can inject a malformed IS-IS LSP PDU, causing the graceful restart procedure to terminate prematurely and resulting in traffic loss after a restart event. The unde...

CVE-2026-73459

CVE-2026-73459 affects Arista EOS with IS-IS configured (versions 4.36.1F and below in the 4.36.x train). An unauthenticated attacker in the same Layer 2 domain can inject a specially crafted IS-IS LSP PDU, causing the legitimate LSP to be purged from the link-state database due to a checksum val...

CVE-2026-73446

CVE-2026-73446 affects Arista EOS on multiple hardware platforms (710, 720D, 720XP, 750X, 7010TX, 7020R, 7130, 7170, 7050X, 7060X, 7260X, 7280R, 7300X, 7320X, 7358X4, 7368X4, 7388X5, 7500R, 7800R, 7700R, AWE, CloudEOS, cEOS/vEOS-lab, CloudVision eXchange). When IS-IS is configured on a broadcast ...

CVE-2026-73444

CVE-2026-73444 affects Arista EOS switches where VRRPv2 is configured with IP-AH authentication enabled. An unauthenticated attacker with access to the layer 2 network segment can bypass VRRP authentication and claim the virtual router master role, enabling them to intercept, modify, or discard t...

CVE-2026-73437

Arista EOS DHCP relay is vulnerable to spoofed DHCP reply forwarding (CWE-345). An unauthenticated attacker on an adjacent network can send crafted DHCP reply packets from a non-helper IP address, which the relay forwards to clients without source validation, potentially supplying malicious netwo...

CVE-2026-19655

CVE-2026-19655 affects Arista EOS when DHCP relay/snooping is configured with Option 82 (information option) or when the DHCP server uses match criteria based on that option. An unauthenticated attacker on a client-facing VLAN can send a specially crafted packet that triggers a DHCP Relay service...