Arista Eos

Arista EOS IGMP Snooping Crash CVE-2026-73462
CVE-2026-73462 6.5 - Medium - September 16, 2026

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.

Out-of-bounds Read

Clear-text gNPSI Client Credentials Logged on Arista EOS
CVE-2026-73457 5.3 - Medium - September 16, 2026

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

Insertion of Sensitive Information into Log File

Arista EOS gRPC gNPSI Remote Code Execution via Unauth Client
CVE-2026-73456 10 - Critical - September 16, 2026

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Code Injection

Arista EOS VRRP Auth Credentials Logged in Cleartext
CVE-2026-73442 3 - Low - September 16, 2026

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.

Insertion of Sensitive Information into Log File

Arista EOS PIMSM Agent DoS 4.34-4.36
CVE-2026-77190 6.5 - Medium - September 16, 2026

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.

Improper Input Validation

Arista EOS Multicast Forwarding State Premature Expiry (<=4.36.1F)
CVE-2026-73468 6.5 - Medium - September 16, 2026

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period.

Always-Incorrect Control Flow Implementation

Arista EOS SNMPv3 Credential Exposure via Hashed Key in Config
CVE-2026-73440 4.2 - Medium - September 16, 2026

On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS). This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Improper Removal of Sensitive Information Before Storage or Transfer

Arista EOS 4.35.0F-4.35.4M Loose uRPF Lacks Drop on 7050X4/7358X4
CVE-2026-73469 5.8 - Medium - September 16, 2026

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

AuthZ

Arista EOS P4Runtime unauth RCE via crafted packet injection
CVE-2026-73453 10 - Critical - September 16, 2026

An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Code Injection

Arista EOS OSPFv3 Agent Restart Vulnerability (Before 4.36.0.1F)
CVE-2026-73455 7.5 - High - September 16, 2026

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

length manipulation

Arista EOS OSPFv3 Agent Restart via Unauth Packet Crash
CVE-2026-73438 5.3 - Medium - September 16, 2026

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.

assertion failure

Arista EOS OSPFv2 Packet Causing OSPF Restart (CVE-2026-73436)
CVE-2026-73436 6.5 - Medium - September 16, 2026

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

Improper Validation of Specified Quantity in Input

Arista EOS gNMI Authorization Bypass Allowing Privilege Escalation
CVE-2026-19640 4.2 - Medium - September 16, 2026

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

AuthZ

Arista EOS gNSI Authz Rotate RPC Policy Activation Bug
CVE-2026-73445 4.9 - Medium - September 16, 2026

On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Improper Input Validation

Arista EOS Sensitive Data Logging via OpenConfig Services
CVE-2026-2380 7.4 - High - September 16, 2026

On affected platforms running Arista EOS with OpenConfig-related services (i.e., gNMI, gNSI, RESTCONF and NETCONF), sensitive requests and responses may be unintentionally logged. These may be stored on the local EOS device or recorded on remote accounting servers. Note that gRPC-based streaming via Streaming Telemetry Agent to CloudVision is not affected by this vulnerability. Examples of sensitive information include: - Sensitive CLI commands (e.g., "username bob secret myPass") - Sensitive OpenConfig YANG leafs (e.g., "system/aaa/global/tacacs/config/secret-key") This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Unprotected Storage of Credentials

Arista EOS gNSI Credentialz Privilege Escalation Bug
CVE-2026-73454 8.1 - High - September 16, 2026

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.

Command Injection

Arista EOS gNMI Pathz Enforcement Bypass (4.33.2F4.36.0.1F)
CVE-2026-73439 7.5 - High - September 16, 2026

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.

Placement of User into Incorrect Group

Arista EOS MLAG Dual Primary State ErrDisable via Unauth Packets (v4.334.36)
CVE-2026-73450 6.9 - Medium - September 16, 2026

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.

Insufficient Verification of Data Authenticity

Premature IS-IS Graceful Restart Termination in Arista EOS <4.36.1F
CVE-2026-73460 6.1 - Medium - September 15, 2026

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.

AuthZ

Arista EOS 4.36.0-4.36.1F IS-IS LSP PDU Injection Causes LSP Purge
CVE-2026-73459 7.4 - High - September 15, 2026

On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.

Improper Validation of Integrity Check Value

Arista EOS 4.31-4.36: IS-IS Adjacency Tear-Down via Crafted Hello PDU
CVE-2026-73446 7.4 - High - September 15, 2026

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

Incorrect Behavior Order

Arista EOS VRRPv2 IP-AH Auth Bypass Enables Master Role Takeover
CVE-2026-73444 4.7 - Medium - September 15, 2026

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.

Incorrect Implementation of Authentication Algorithm

Arista EOS TACACS+ Plaintext Secret Exposure in 4.32.04.36.1F
CVE-2026-73467 6.3 - Medium - September 15, 2026

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

Insertion of Sensitive Information into Log File

Arista EOS Private Key Log Leak (v4.36.0-4.32.0)
CVE-2026-73465 6.3 - Medium - September 15, 2026

On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Insertion of Sensitive Information into Log File

Arista EOS <=4.36.0F Password Auth Creates Orphan Sess Auth Exhaustion
CVE-2026-19641 5.3 - Medium - September 15, 2026

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Output Sanitization

Arista EOS 4.34.0-4.36.0.1F, SVI ACL Disable on Shared SVIs
CVE-2026-73451 4.8 - Medium - September 15, 2026

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

1419

EOS 4.x Race Condition Leaves Supplicant Authorized After Clear Dot1X Host-All
CVE-2026-75945 2.6 - Low - September 14, 2026

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

Insufficient Cleanup

Race Cond. in EOS 4.36.x ACL Agent Leaves Stale Entry (CVE-2026-75944)
CVE-2026-75944 2.6 - Low - September 14, 2026

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.

Insufficient Cleanup

Arista EOS Traffic Leakage on Supplicant Removal (4.36.0)
CVE-2026-75943 2.6 - Low - September 14, 2026

A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.

Insufficient Cleanup

Arista EOS 4.35.0 ACL Bypass via Authenticated Supplicant Window
CVE-2026-77191 2.6 - Low - September 14, 2026

An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.

AuthZ

Arista EOS 4.34-4.36 RADIUS Proxy Dynamic Auth Bypass
CVE-2026-73449 5.9 - Medium - September 14, 2026

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Authentication Bypass by Spoofing

Arista EOS <4.36: VXLAN/GRE Decap Misidentification Leads to Tunnel Spoofing
CVE-2026-7473 5.8 - Medium - June 05, 2026

On affected platforms running Arista EOS where a tunnel decapsulation configurationsuch as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interfaceis present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Incomplete Comparison with Missing Factors

Arista EOS IPsec DP DoS 4.33.x and 4.32.x series
CVE-2025-8873 7.5 - High - June 04, 2026

On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.

Improper Validation of Syntactic Correctness of Input

EOS 4.254.31 Auth Bypass via 802.1x on Access VLANs
CVE-2023-5502 5.9 - Medium - June 04, 2026

On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication.

authentification

Arista EOS <=4.32: ACL MACsec Egress Bypass
CVE-2024-27891 5.3 - Medium - June 04, 2026

On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied.

Authorization

Arista EOS 4.284.31: Unauth Host via EAPOL in 802.1X Mode
CVE-2024-6858 6.5 - Medium - June 04, 2026

In Aristas EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

Improper Validation of Specified Type of Input

Arista EOS MACsec Crash via Crafted Packet (4.34.3.1M)
CVE-2025-7048 4.3 - Medium - January 06, 2026

On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuous receipt of these packets with certain MACsec configurations can cause longer term disruption of dataplane traffic.

Buffer Access with Incorrect Length Value

Arista EOS OSPFv3 CPU Exhaustion via Crafted Packet
CVE-2025-8872 6.5 - Medium - December 16, 2025

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSFPv3 process to have high CPU utilization which may result in the OSFPv3 process being restarted. This may cause disruption in the OSFPv3 routes on the switch. This issue was discovered internally by Arista and is not aware of any malicious uses of this issue in customer networks.

Resource Exhaustion

Arista EOS IPsec Anti-Replay Duplicate Packet Forgery Vulnerability
CVE-2025-2796 - May 27, 2025

On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability. Note: this issue does not affect VXLANSec or MACSec encryption functionality.

Arista EOS Traffic Policy Skip Untagged Packets – Improper Drop
CVE-2024-9448 - May 08, 2025

On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being delivered to unexpected destinations.

Arista EOS Tunnelsec Agent Restart Exposes Packets in Clear over Secure VxLAN
CVE-2024-12378 - May 08, 2025

On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan tunnels in the clear.

Arista EOS gNOI RPC Exposes Remote Credentials via Logging
CVE-2025-0936 - May 07, 2025

On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possibly on other remote accounting servers (i.e. TACACS, RADIUS, etc).

Arista EOS gNOI bypass allows unauthorized config changes
CVE-2025-1260 - March 04, 2025

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.

Arista EOS gNOI Request Bypass via OpenConfig
CVE-2025-1259 - March 04, 2025

On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in users retrieving data that should not have been available

Arista EOS VLAN Tag Misprocessing Causing Control Plane Instability
CVE-2024-5872 - January 10, 2025

On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc.

Arista EOS SNMP snmpd Mem Leak by Crafted Packet
CVE-2024-7095 - January 10, 2025

On affected platforms running Arista EOS with SNMP configured, if snmp-server transmit max-size is configured, under some circumstances a specially crafted packet can cause the snmpd process to leak memory. This may result in the snmpd process being terminated (causing SNMP requests to time out until snmpd is restarted) and memory pressure for other processes on the switch. Increased memory pressure can cause processes other than snmpd to be at risk for unexpected termination as well.

Arista EOS PBR/BGP Flowspec IP Options Bypass
CVE-2024-6437 - January 10, 2025

On affected platforms running Arista EOS with one of the following features configured to redirect IP traffic to a next hop: policy-based routing (PBR), BGP Flowspec, or interface traffic policy -- certain IP traffic such as IPv4 packets with IP options may bypass the feature's set nexthop action and be slow-path forwarded (FIB routed) by the kernel as the packets are trapped to the CPU instead of following the redirect action's destination.

Arista EOS DHCP Relay Agent Crash via Malformed DHCP Packet
CVE-2023-24510 7.5 - High - June 05, 2023

On the affected platforms running EOS, a malformed DHCP packet might cause the DHCP relay agent to restart.

Improper Handling of Exceptional Conditions

Privilege Escalation in Arista EOS Standby Supervisor via RPR/SSO
CVE-2023-24509 7.8 - High - April 13, 2023

On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading to a privilege escalation. Valid user credentials are required in order to exploit this vulnerability.

Arista EOS PTP Agent Crash DoS from Malformed PTP TLV
CVE-2021-28510 7.5 - High - January 26, 2023

For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.

Improper Validation of Specified Quantity in Input