EUVD-2026-80325

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-19640 Security Advisory 0170

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-19640

CVE-2026-19640 is an incorrect authorization flaw (CWE-863) in Arista EOS affecting the gNMI (gRPC Network Management Interface) . An authenticated user with gNMI access may receive incorrect authorization results, potentially gaining access beyond their assigned permissions. Arista discovered th...

CVE-2026-73463 Security Advisory 0169

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

CVE-2026-73463

Arista EOS devices with multiple gNSI transports configured are subject to a race condition (CWE-362) in the gNSI Authz service that can cause a policy rotation to fail silently , allowing an authenticated user whose access was revoked to retain unauthorized access to gRPC interfaces. The issue w...

EUVD-2026-80319

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

CVE-2026-73463 Security Advisory 0169

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface gNSI transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

EUVD-2026-80317

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445 Security Advisory 0167

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...

CVE-2026-73445

Arista EOS is affected by a vulnerability in the gNSI (gRPC Network Security Interface) Authz Rotate RPC component, classified as CWE-20 (Improper Input Validation) . The bug may cause an incorrect Authz policy uploaded within an ongoing RPC stream to become the active policy, resulting in a poli...

CVE-2026-2380 Security Advisory 0168

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-2380

CVE-2026-2380 affects Arista EOS when OpenConfig-related services (gNMI, gNSI, RESTCONF, or NETCONF) are enabled. The OpenConfig/Octa agent may unintentionally log sensitive requests and responses—such as CLI commands containing passwords or OpenConfig YANG secret-key leafs—to local agent logs or...

EUVD-2026-80313

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-2380 Security Advisory 0168

On affected platforms running Arista EOS with OpenConfig-related services i.e., gNMI, gNSI, RESTCONF and NETCONF, sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming vi...

CVE-2026-73464 Security Advisory 0166

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

CVE-2026-73464

Arista EOS is affected via its gRPC Network Management Interface (gNMI) component. A specially crafted request from an authenticated client with gNMI access can execute arbitrary code with root privileges on the switch. The root cause is classified as CWE-94 (Code Injection) . Exploitation requir...

CVE-2026-73464 Security Advisory 0166

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

EUVD-2026-80295

On affected platforms running Arista EOS with gRPC Network Management Interface gNMI enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface gNMI access to execute arbitrary code with root privileges on the switch...

CVE-2026-73454

Arista EOS devices with gNSI Credentialz enabled are vulnerable to a command injection (CWE-77) that allows a network attacker with low privileges to craft a request causing unintended modifications to a target account's properties, potentially granting elevated privileges . Affected EOS releases...