EUVD-2026-80083
GHSA-w26w-6gr3-j89v
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 16, 2026
Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.
Earlier versions of this analysis (1)
Packet injection against MLAG Dual Primary Detection in Arista EOS allows an unauthenticated attacker on the dual-primary detection segment to corrupt a switch's view of MLAG state. If the MLAG primary switch fails while those crafted packets are present, the secondary incorrectly believes a dual-primary condition exists and err-disables its interfaces, tearing down forwarding across the MLAG pair and causing a traffic interruption. Arista has published a fix, and no public exploit code or CISA KEV entry was identified at time of analysis; the 6.9 CVSS reflects that exploitation requires adjacency to a normally isolated segment plus a failure-timing coincidence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Eos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H
Primary rating from Vendor (Arista) · only source for this CVE.
CVSS VectorVendor: Arista
Lifecycle Timeline
4DescriptionCVE.org
On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Related Vulnerabilities in Arista EOS IS-IS and MLAG Protocol Flaws
View all 4GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execut
Remote code execution in OpenSSH's sshd server (regression of CVE-2006-5051) allows unauthenticated remote attackers to
Tunnel decapsulation logic in Arista EOS fails to verify the encapsulation protocol type, allowing any tunneled packet d
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI)
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundan
Heap-based buffer overflow in the PCNET controller in QEMU allows remote attackers to execute arbitrary code by sending
Arista EOS before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.
On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error ma
On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the
Exploit-DB