CVE-2026-73438
published 2026-09-16CVE-2026-73438: On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast…
PriorityP426medium5.3CVSS 3.1
AVAACHPRNUINSUCNINAH
EPSS
0.21%
12.0th percentile
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista_networks | eos | >= 1.0.0 < 4.33.0F | 4.33.0F |
| arista_networks | eos | 4.33.0F – 4.33.9M | — |
| arista_networks | eos | 4.34.0F – 4.34.7M | — |
| arista_networks | eos | 4.35.0F – 4.35.5M | — |
| arista_networks | eos | 4.36.0F – 4.36.1F | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.0HIGHCVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Arista EOS up to 4.36.1F OSPFv3 input validation (WID-SEC-2026-3441)
vuldb·2026-09-17·CVSS 5.3
CVE-2026-73438 [MEDIUM] Arista EOS up to 4.36.1F OSPFv3 input validation (WID-SEC-2026-3441)
A vulnerability categorized as critical has been discovered in Arista EOS up to 4.32.x/4.33.9M/4.34.7M/4.35.5M/4.36.1F. Affected is an unknown function of the component OSPFv3. Such manipulation leads to improper input validation.
This vulnerability is uniquely identified as CVE-2026-73438. The attack can be launched remotely. No exploit exists.
It is advisable to upgrade the affected component.
GHSA
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set o
ghsa_unreviewed·2026-09-16
CVE-2026-73438 [HIGH] CWE-617 On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set o
On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-16
Published