Arista Networks

CVE	Summary	Severity	CVSS	EPSS	Priority	Signals
CVE-2026-73447	Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.	CRITICAL	9.4	0.8%	68	PoC
CVE-2026-73453	Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.	CRITICAL	9.5	0.7%	48
CVE-2026-73461	Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.	CRITICAL	9.4	0.3%	47
CVE-2026-73455	Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.	HIGH	8.9	0.5%	45
CVE-2026-73464	Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.	HIGH	8.7	0.5%	44
CVE-2026-86106	Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.	HIGH	8.7	–	44
CVE-2026-73454	Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.	HIGH	8.6	0.3%	43
CVE-2026-86107	An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.	HIGH	8.2	–	41
CVE-2026-73439	Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.	HIGH	7.7	0.3%	39	No patch
CVE-2026-86108	OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.	HIGH	7.5	0.8%	38	PoC
CVE-2026-73468	Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.	HIGH	7.1	0.3%	36
CVE-2026-73435	Crafted OSPFv2 packets sent by an unauthenticated attacker on the same broadcast segment can force adjacency flapping, packet loss, and wider routing disruption on Arista EOS switches and routers that have OSPFv2 configured together with OSPFv2 authentication. Affected maintenance trains identified in EUVD are EOS below 4.33.0F and the 4.33.x (through 4.33.9M), 4.34.x (through 4.34.7M), 4.35.x (through 4.35.5M), and 4.36.x (through 4.36.1F) branches; the CVSS 4.0 base score is 7.0 (AV:A/AC:L/AT:P/PR:N/UI:N, VC:N/VI:N/VA:H/SC:N/SI:N/SA:H), and our independent 3.1 assessment scores it AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, so the impact is strictly availability - no confidentiality or integrity loss - and the 'Information Disclosure' tag attached to this record is misleading. No CISA KEV listing is present and no public exploit code has been identified at time of analysis; authentication requirements are unauthenticated per the PR:N vector, with the compensating prerequisite being adjacency to the OSPFv2 segment rather than any credential.	HIGH	7.0	0.2%	35
CVE-2026-73450	Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.	HIGH	7.0	0.1%	35
CVE-2026-73438	A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.	HIGH	7.0	0.2%	35
CVE-2026-73445	An incorrect authorization policy can become active on Arista EOS devices through the gRPC Network Security Interface (gNSI) Authz Rotate RPC, allowing a high-privilege authenticated remote attacker to alter the device's active Authz policy. This integrity-only issue is rated CVSS 4.0 6.9 (Medium; CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) and requires privileged gNSI management credentials; the Bootz service is explicitly unaffected. No public exploit identified at time of analysis, and Arista reports the issue was discovered internally with no known malicious use in customer networks.	MEDIUM	6.9	0.3%	35

CVE-2026-73447

Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

CRITICAL

9.4

0.8%

68

PoC

CVE-2026-73453

Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.

CRITICAL

9.5

0.7%

48

CVE-2026-73461

Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.

CRITICAL

9.4

0.3%

47

CVE-2026-73455

Crafted OSPFv3 packets can force an unexpected restart of the OSPFv3 routing agent on Arista EOS devices that have OSPFv3 configured, causing a transient loss of routing adjacencies and traffic disruption. The flaw is an availability-only denial of service (CWE-130 improper handling of length parameters) with no code execution, data disclosure, or persistence; no authentication is required (PR:N) and no user interaction is needed (UI:N), but exploitation depends on a preconditioned packet and, per our assessment, an attacker positioned on the same OSPFv3-participating link or adjacency domain rather than arbitrarily across the internet. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor has published Security Advisory 0173.

HIGH

8.9

0.5%

45

CVE-2026-73464

Authenticated remote code execution in Arista EOS allows a malicious client with valid gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch by sending a single specially crafted request. Only switches where gNMI has been explicitly enabled are exposed - gNMI is a non-default management API - and the attacker must already hold working gNMI credentials, which limits practical exposure to insiders or adversaries who have already compromised network-automation or management accounts, but grants them full root control of the device with low attack complexity and no user interaction. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV listing); no EPSS score was provided. The vendor has published security advisory SA-0166 at https://www.arista.com/en/support/advisories-notices/security-advisory/24722-security-advisory-0166.

HIGH

8.7

0.5%

44

CVE-2026-86106

Unauthenticated elevated command execution is possible on Arista VeloCloud Edge appliances whenever High Availability is enabled, because the HA peer functions perform no caller verification (CWE-306). An attacker positioned on the private HA interconnect can invoke sensitive peer operations and obtain full confidentiality, integrity and availability impact on the Edge unit, reflected by a CVSS 4.0 base score of 8.7 (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H). No public exploit code has been identified at time of analysis, and the exploitable surface is adjacent-only - it is the HA interconnect segment rather than the routed internet, and units without HA configured are not affected.

HIGH

8.7

–

44

CVE-2026-73454

Command injection in the gRPC Network Security Interface (gNSI) Credentialz service of Arista EOS allows an authenticated, low-privileged attacker with access to the gRPC management endpoint to send a crafted request that modifies a target account's properties, potentially granting that account elevated privileges or broader access than an administrator intended (CVSS 4.0 base 8.6; assessed CVSS 3.1 8.6, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N). Exposure is conditional: the device must be running an affected EOS maintenance train (4.30.0F through 4.36.0.1F) with gNSI Credentialz configured, a non-default management feature, and the attacker must already hold authenticated access to that endpoint, making this a privilege-escalation-from-foothold rather than an anonymous remote compromise. A vendor patch is available per the Arista advisory; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is narrower in practice than the raw score suggests because of the configuration prerequisite.

HIGH

8.6

0.3%

43

CVE-2026-86107

An out-of-bounds write in Arista VeloCloud Edge and VeloCloud Gateway affects the VCMP tunnel protocol when it processes tunneled IP fragments, causing the affected process to crash and restart and briefly disrupting traffic on the affected SD-WAN node. Exploitation requires the attacker to already be an authenticated overlay neighbor with an established VCMP peer relationship to the target (assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) - internet hosts that are unauthenticated and cannot form an overlay peer relationship cannot reach the vulnerable logic. No public exploit code has been identified at time of analysis; the impact is bounded to a temporary availability loss, with no code execution or data compromise demonstrated.

HIGH

8.2

–

41

CVE-2026-73439

Mis-enforced authorization in Arista EOS allows an authenticated gNMI user to read or write management paths that an active gNSI Pathz policy is meant to deny, specifically when a single Pathz policy contains both a group rule and a user rule referencing the same path. Exposure is limited to EOS deployments that combine OpenConfig, a running gNMI server, and gNSI Pathz authorization - a non-default, advanced management-plane configuration - and the attacker must already hold valid gNMI credentials, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (confidentiality and integrity High, no availability impact). No public exploit code exists and there is no confirmed active exploitation (not in CISA KEV); the supplied CVSS 4.0 score of 7.7 overstates day-to-day risk given the narrow prerequisite stack.

HIGH

7.7

0.3%

39

No patch

CVE-2026-86108

OS command injection in Arista VeloCloud Edge management and configuration workflows allows input supplied through those workflows to be interpreted as an operating-system command, resulting in command execution with elevated privileges on the appliance. Exploitation requires a high-privileged management request or the ability to write a configuration value, so this is primarily a privileged-insider, compromised-admin-account, or post-compromise escalation risk rather than an unauthenticated internet-facing flaw. No public exploit code or active exploitation has been identified at time of analysis, and no EPSS score was supplied with the record.

HIGH

7.5

0.8%

38

PoC

CVE-2026-73468

Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.

HIGH

7.1

0.3%

36

CVE-2026-73435

Crafted OSPFv2 packets sent by an unauthenticated attacker on the same broadcast segment can force adjacency flapping, packet loss, and wider routing disruption on Arista EOS switches and routers that have OSPFv2 configured together with OSPFv2 authentication. Affected maintenance trains identified in EUVD are EOS below 4.33.0F and the 4.33.x (through 4.33.9M), 4.34.x (through 4.34.7M), 4.35.x (through 4.35.5M), and 4.36.x (through 4.36.1F) branches; the CVSS 4.0 base score is 7.0 (AV:A/AC:L/AT:P/PR:N/UI:N, VC:N/VI:N/VA:H/SC:N/SI:N/SA:H), and our independent 3.1 assessment scores it AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H, so the impact is strictly availability - no confidentiality or integrity loss - and the 'Information Disclosure' tag attached to this record is misleading. No CISA KEV listing is present and no public exploit code has been identified at time of analysis; authentication requirements are unauthenticated per the PR:N vector, with the compensating prerequisite being adjacency to the OSPFv2 segment rather than any credential.

HIGH

7.0

0.2%

35

CVE-2026-73450

Crafted packets injected onto the MLAG Dual Primary Detection segment can trick an Arista EOS switch into falsely concluding it is in a dual-primary condition and err-disabling its interfaces, abruptly cutting off traffic for everything downstream of that switch. Exploitation needs only layer-2 adjacency to the Dual Primary Detection segment with no authentication (CVSS 4.0 AV:A/PR:N/UI:N), but it is gated by a precondition: the MLAG primary switch must fail while the crafted packets are present, so this is a conditional denial-of-service rather than a mass-exploitable remote attack. Affected EOS branches include 4.33.x, 4.34.x, 4.35.x and 4.36.x; a vendor patch is available and no public exploit code or active exploitation has been identified at time of analysis.

HIGH

7.0

0.1%

35

CVE-2026-73438

A crafted multi-packet sequence sent by an unauthenticated attacker on the same OSPFv3 broadcast domain can force the Ospf3 agent on Arista EOS devices to restart, dropping all OSPFv3 adjacencies and potentially disrupting routing across the wider OSPF domain until the agent recovers. The flaw only affects EOS platforms where OSPFv3 is explicitly configured, and exposure is limited to link-local/L2-adjacent positions rather than routable Internet reach; exploitation is a genuine availability-only issue (CWE-617, reachable assertion), with no confidentiality or integrity impact and no public exploit identified at time of analysis, and Arista states it is not aware of malicious exploitation in customer networks.

HIGH

7.0

0.2%

35

CVE-2026-73445

An incorrect authorization policy can become active on Arista EOS devices through the gRPC Network Security Interface (gNSI) Authz Rotate RPC, allowing a high-privilege authenticated remote attacker to alter the device's active Authz policy. This integrity-only issue is rated CVSS 4.0 6.9 (Medium; CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) and requires privileged gNSI management credentials; the Bootz service is explicitly unaffected. No public exploit identified at time of analysis, and Arista reports the issue was discovered internally with no known malicious use in customer networks.

MEDIUM

6.9

0.3%

35

Severity Breakdown

Monthly CVE Trend

Affected Products (6)

Top Risky CVEs