Arista EOS CVE-2026-73464

Exploitation requires (1) the gRPC Network Management Interface (gNMI) to be enabled on the Arista EOS switch - a non-default management API that must be explicitly configured - and (2) the attacker to be an authenticated client already possessing valid gNMI access credentials (PR:L). Given those prerequisites, a single specially crafted gNMI request executes code as root with low attack complexity and no user interaction. Limiting factors: switches without gNMI enabled are not exposed, and the credential requirement restricts exploitation to insiders or attackers who have already compromised network-management/automation accounts rather than fully anonymous remote actors.

This is a genuinely high-priority vulnerability that warrants prompt patching. The vendor-supplied CVSS 4.0 vector (8.7, AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, yielding full high impact to confidentiality, integrity and availability - consistent with the description's claim of arbitrary code execution as root. The critical caveat is PR:L: this is NOT unauthenticated, so an attacker must already hold valid gNMI credentials, and gNMI must be explicitly enabled (a non-default management interface), both of which meaningfully narrow the exploit population to insiders or actors who have already compromised management credentials. No EPSS score, KEV listing, POC, or SSVC data was provided in the input, so exploitation likelihood cannot be quantified and there is no evidence of active exploitation - the exploitation status is best characterized as no public exploit identified at time of analysis. Signals are internally consistent (no contradiction between network vector and the authenticated-client description, since gNMI is a network-facing management API), so the main uncertainty is the absence of exploitation-probability data rather than conflicting data. Bottom line: root RCE on core network infrastructure is a real priority, tempered by the authentication and gNMI-enabled prerequisites.

An attacker who has obtained valid gNMI credentials (a malicious insider, or an external actor who has phished or otherwise compromised a network-automation service account) sends a specially crafted gNMI request to an Arista EOS switch with the gNMI interface enabled. The malformed request triggers code injection (CWE-94) in the gNMI handling path, executing attacker-controlled code with root privileges on the switch. No public exploit code is identified in the provided data.