CVE-2026-73447: Improper Neutralization of Special Elements used in an OS Command

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary...

CVE-2026-73454: Improper Neutralization of Special Elements used in a Command

On affected platforms running Arista EOS with gRPC Network Security Interface gNSI Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an...

CVE-2026-73445: Improper Input Validation

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface gNSI Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the...