EUVD-2026-80996

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be...

CVE-2026-73443

Arista EOS is vulnerable to a VRRPv2 IP-AH authentication capture-replay attack (CWE-294). An unauthenticated attacker on the same layer 2 segment can replay a legitimate authenticated VRRP advertisement to advertise stale state, preventing a backup router from assuming the virtual gateway role a...

CVE-2026-77190

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...

CVE-2026-73469

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...

CVE-2026-73453

An unauthenticated P4Runtime Programming Protocol-Independent Packet Processors Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious...

CVE-2026-73455

On affected platforms running Arista EOS with Open Shortest Path First version 3 OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly...

CVE-2026-73440

On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...

CVE-2026-73435

On affected platforms running Arista EOS with Open Shortest Path First version 2 OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption...

CVE-2026-73438

On affected platforms running Arista EOS with Open Shortest Path First version 3 OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of...

CVE-2026-73436

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly...

CVE-2026-19640

On affected platforms running Arista EOS, an authenticated user with access to the gNMI gRPC Network Management Interface may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the...

CVE-2026-77190

CVE-2026-77190 affects Arista EOS where an unauthenticated, network-adjacent attacker can send malformed PIM Sparse Mode messages to a device with both PIM SM and MLAG configured, causing the Pimsm agent to crash. Repeated attacks produce a sustained denial of service through continuous agent res...

EUVD-2026-80388

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...

CVE-2026-77190 Security Advisory 0177

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically...

EUVD-2026-80590

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...

CVE-2026-73440 Security Advisory 0178

On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...

CVE-2026-73469 Security Advisory 0176

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding uRPF configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the...

EUVD-2026-80591

On affected platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to thi...

CVE-2026-73469

Arista EOS on 7050X4 and 7358X4 series platforms running EOS 4.35.4M or below in the 4.35.x train is affected by a loose Unicast Reverse Path Forwarding (uRPF) bypass (CWE-863). When loose-mode uRPF is configured on an interface, certain traffic that should be dropped based on route verification ...

CVE-2026-73440

Arista EOS devices with SNMPv3 configured may expose user credentials as a one-way hashed key in running and sanitized configurations when using the legacy CLI syntax (without the key format). An authenticated user could leverage this to perform unauthorized SNMP table reads or send fraudulent ...