Arista EOS CVE-2026-73445

Exploitation requires access to the gNSI (gRPC Network Security Interface) Authz Rotate RPC on an Arista EOS device and initiating a policy-rotation stream - a management-plane operation that demands high-privilege authenticated access (PR:H). The specific trigger is that an incorrect Authz policy carried in the ongoing (in-flight) Rotate RPC stream is committed as the active policy. The Bootz service is explicitly not affected, and the issue is limited to the Authz Rotate path. Limiting factors: the attacker must already hold privileged gNSI management credentials, the device must expose/use the gNSI Authz service, and there is no user-interaction or availability angle - impact is confined to authorization-policy integrity.

This is a moderate, integrity-only issue, correctly scored as CVSS 4.0 6.9 (Medium). The vendor vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N is well-calibrated and internally consistent: the flaw is reachable only through the gNSI Authz Rotate RPC, a management-plane operation on Arista EOS that requires an authenticated, high-privilege operator (PR:H) - this is NOT an unauthenticated remote-exploit condition despite the network attack vector. Impact is confined to integrity (VI:H): a wrong Authz policy from the in-flight RPC stream can be committed as the active policy. There is no confidentiality (VC:N) or availability (VA:N) impact, which directly contradicts the 'Information Disclosure' tag on this record. Exploitation signals are all cold: no KEV listing, no public POC, and no EPSS supplied; Arista states it discovered the issue internally and is aware of no malicious use in customer networks. The realistic driver here is accidental misconfiguration or an insider/compromised-operator abusing a legitimate rotate operation rather than mass exploitation. Net: a legitimate patch-management item for Arista operators, not an emergency - the PR:H barrier and absence of any exploitation evidence keep real-world risk low-to-moderate.

An operator (or an attacker who has already obtained high-privilege gNSI management credentials) issues an Authz Rotate RPC to update authorization policy on an EOS device; due to improper handling, an incorrect policy uploaded within the ongoing RPC stream is committed and becomes the active Authz policy instead of the intended one. This can silently weaken or otherwise corrupt the device's authorization enforcement. No public exploit code exists and Arista reports no observed malicious use.