VYPR
Vypr IntelligenceAI-generatedSep 16, 2026· 25 CVEs

Arista EOS: 25 Vulnerabilities Disclosed, Including Critical Code Execution Flaws

Arista disclosed 25 vulnerabilities in EOS on Sept 16, 2026, including critical flaws enabling code execution via gRPC and other network protocols.

Key findings

  • 25 vulnerabilities disclosed on September 16, 2026, affecting Arista EOS.
  • Critical vulnerabilities (CVE-2026-73453, CVE-2026-73447) allow arbitrary code execution.
  • Multiple high-severity flaws impact gNMI, gNSI, and OpenConfig services.
  • Networking protocols like IGMP, VRRP, OSPF, PIM, and IS-IS are affected by DoS and stability issues.
  • Arista has released patches; users must consult advisories for affected versions and remediation.
  • Several vulnerabilities involve credential exposure or authorization bypass.

On September 16, 2026, Arista disclosed a significant batch of 25 vulnerabilities affecting its Arista EOS network operating system. The vulnerabilities, disclosed within a 19-hour window, range in severity from Low to Critical, with several critical flaws enabling arbitrary code execution and full administrative control. These issues impact various network protocols and management interfaces, including IGMP snooping, gRPC Network Packet Sampling Interface (gNPSI), VRRP, OSPFv3, P4Runtime, SNMP, gNMI, gNSI, OpenConfig, and IS-IS. The sheer volume and severity of these vulnerabilities underscore the importance of timely patching and security review for Arista EOS deployments.

Several vulnerabilities center around the gRPC Network Management Interface (gNMI) and gRPC Network Security Interface (gNSI). CVE-2026-73457 and CVE-2026-73440 highlight potential credential exposure in clear text or hashed formats within logs and configurations, accessible to authenticated users. More critically, CVE-2026-73464 allows an authenticated client with gNMI access to execute arbitrary code with root privileges. Similarly, CVE-2026-73453 and CVE-2026-73447 present critical risks, enabling arbitrary code execution via P4Runtime and gNSI Certz respectively, with CVE-2026-73447 specifically allowing privilege escalation to root. CVE-2026-73461 and CVE-2026-73454 also involve authorization bypass and unintended modifications to account properties within gRPC-related services. CVE-2026-2380 notes that sensitive requests and responses for OpenConfig-related services may be unintentionally logged. CVE-2026-73445 points to an issue with the gNSI Authz Rotate RPC potentially activating an incorrect policy. CVE-2026-73439 indicates that gNMI may fail to enforce policies correctly when both group and user rules are present for the same path.

Other vulnerabilities affect core networking protocols. CVE-2026-73462 describes a denial-of-service vulnerability in IGMP snooping, triggered by malformed packets. CVE-2026-73443 and CVE-2026-73442 relate to VRRPv2, with the former allowing replay attacks and the latter logging credentials in cleartext. CVE-2026-77190 details a denial-of-service vulnerability in PIM Sparse Mode when MLAG is configured. CVE-2026-73469 discusses a loose Unicast Reverse Path Forwarding (uRPF) configuration that may lead to unintended traffic forwarding. OSPF protocols are also impacted: CVE-2026-73455 and CVE-2026-73438 describe OSPFv3 agent restarts due to crafted packets, with CVE-2026-73438 specifically mentioning loss of adjacencies. CVE-2026-73436 and CVE-2026-73435 affect OSPFv2 and segment routing, causing agent restarts and potential routing disruptions. IS-IS is affected by CVE-2026-73460 and CVE-2026-73459, which can lead to premature termination of graceful restart procedures or purging of Link-State PDUs, resulting in traffic loss. Finally, CVE-2026-73450 describes an attack on MLAG Dual Primary Detection.

Arista has released software updates to address these vulnerabilities. Users are strongly advised to consult Arista's official advisories for specific version information and recommended upgrade paths. The broad impact across multiple services and protocols necessitates a comprehensive review of security configurations and prompt application of patches to mitigate the risk of exploitation, particularly for the critical vulnerabilities allowing arbitrary code execution.

The coordinated disclosure of these 25 vulnerabilities highlights a significant security event for Arista EOS users. The presence of multiple critical flaws, especially those enabling remote code execution and privilege escalation through management interfaces like gNMI and gNSI, poses a substantial risk. Network administrators should prioritize patching these vulnerabilities to prevent potential compromise and maintain the integrity and availability of their network infrastructure.

Key Findings:

  • 25 vulnerabilities disclosed on September 16, 2026, affecting Arista EOS.
  • Critical vulnerabilities (CVE-2026-73453, CVE-2026-73447) allow arbitrary code execution.
  • Multiple high-severity flaws impact gNMI, gNSI, and OpenConfig services.
  • Networking protocols like IGMP, VRRP, OSPF, PIM, and IS-IS are affected by DoS and stability issues.
  • Arista has released patches; users must consult advisories for affected versions and remediation.
  • Several vulnerabilities involve credential exposure or authorization bypass.

CVE IDs: CVE-2026-73462, CVE-2026-73457, CVE-2026-73456, CVE-2026-73443, CVE-2026-73442, CVE-2026-77190, CVE-2026-73469, CVE-2026-73455, CVE-2026-73453, CVE-2026-73440, CVE-2026-73438, CVE-2026-73436, CVE-2026-73435, CVE-2026-19640, CVE-2026-73464, CVE-2026-73463, CVE-2026-73461, CVE-2026-73454, CVE-2026-73445, CVE-2026-73439, CVE-2026-2380, CVE-2026-73447, CVE-2026-73450, CVE-2026-73460, CVE-2026-73459

AI-written article. Grounded in 25 CVE records listed below.