EUVD-2026-80065
GHSA-vq63-cff6-37q2
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Integrity verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Let me synthesize.
CVE-2026-73459: Arista EOS IS-IS LSP purge via crafted IS-IS LSP PDU. Unauthenticated attacker with adjacency/adjacent network access. CVSS 4.0: AV:A (adjacent), AC:L, AT:P (attack requirements present), PR:N, UI:N, VC:N, VI:N, VA:H, SC:N, SI:N, SA:H.
CWE-354: Improper Validation of Integrity Check Value. Hmm, CWE-354 is "Improper Validation of Integrity Check Value". Actually CWE-354 is "Improper Validation of Integrity Check Value". Yes. So the crafted LSP with invalid/wrong checksum (IS-IS LSP checksum) isn't validated, causing legitimate LSP to be purged (sequence number manipulation / LSP purge).
Actually the scenario: attacker injects crafted IS-IS LSP PDU that purges a legitimate LSP from the link-state database — likely by spoofing LSP with same LSP ID (source ID + pseudonode ID) with... Actually removal could happen by a zero-lifetime LSP or by "purge" mechanism with Remaining Lifetime = 0. In IS-IS, an LSP with remaining lifetime 0 is purged. So crafted LSP with matching LSP ID and Remaining Lifetime 0 plus invalid checksum being accepted → purges legitimate LSP.
AV:A — adjacent network — requires attacker on same broadcast segment / L2 adjacency, must be able to send IS-IS PDUs (L2 multicast, no auth if authentication not configured). AT:P — attack requirements present: need to be on an IS-IS enabled link/adjacency; possibly need to be able to form adjacency or at least inject raw L2 frames. PR:N — no auth (if IS-IS authentication is not configured). But PR:N in CVSS 4.0 means none — no privileges required. However, if IS-IS authentication is configured, injection requires the auth key — hence AT:P captures the requirement.
EPSS: not given. KEV: not given (not listed). POC: not given.
Patch: EOS 4.36.0 ≤4.36.1F affected; advisory 0160 available. Fix version not explicitly given in input — the advisory presumably lists fixed versions. I should not invent. So: "Patch available per vendor advisory" — advisory SAF-0160 at arista.com.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
Primary rating from Vendor (arista) · only source for this CVE.
CVSS VectorVendor: arista
DescriptionCVE.org
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB