CVE-2026-73456 Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface gNPSI enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised...

CVE-2026-73456

Arista EOS platforms with the gNPSI (gRPC Network Packet Sampling Interface) enabled are vulnerable to unauthenticated arbitrary code execution via crafted gNPSI requests (CWE-94, code injection), granting full administrative control of the switch. CVSS 3.1 score: 10.0 . Exploitation requires gNP...

CVE-2026-73442

CVE-2026-73442 affects Arista EOS switches with VRRP configured (any version; authentication not required). The root cause is CWE-532 : peer device VRRP authentication credentials are written in cleartext to agent trace logs on the switch. An authenticated user with sufficient privileges (or a sy...

CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs or a system receiving forwarded log output to obtain the peer devic...

CVE-2026-73442 On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs or a system receiving forwarded log output to obtain the peer devic...

EUVD-2026-81000

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs or a system receiving forwarded log output to obtain the peer devic...

EUVD-2026-80996

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-73443

Arista EOS is vulnerable to a VRRPv2 IP-AH authentication capture-replay attack (CWE-294). An unauthenticated attacker on the same layer 2 segment can replay a legitimate authenticated VRRP advertisement to advertise stale state, preventing a backup router from assuming the virtual gateway role a...

CVE-2026-73443 On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indef

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

CVE-2026-77190

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...

CVE-2026-73455

On affected platforms running Arista EOS with Open Shortest Path First version 3 OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly...

CVE-2026-73469

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...

CVE-2026-73453

An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...

CVE-2026-73436

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly...

CVE-2026-73440

On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...

CVE-2026-73435

On affected platforms running Arista EOS with Open Shortest Path First version 2 OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption...

CVE-2026-73438

On affected platforms running Arista EOS with Open Shortest Path First version 3 OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of...

CVE-2026-19640

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...