CVE-2026-73445
published 2026-09-16CVE-2026-73445: On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which…
PriorityP428medium4.9CVSS 3.1
AVNACLPRHUINSUCNIHAN
EPSS
0.33%
25.9th percentile
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista_networks | eos | >= 4.31.0F < 4.32.0F | 4.32.0F |
| arista_networks | eos | >= 4.32.0F < 4.33.0F | 4.33.0F |
| arista_networks | eos | 4.33.0F – 4.33.8M | — |
| arista_networks | eos | 4.34.0F – 4.34.7M | — |
| arista_networks | eos | 4.35.0F – 4.35.5M | — |
| arista_networks | eos | 4.36.0F – 4.36.0.1F | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Arista EOS up to 4.36.0.1F gRPC Network Security Interface input validation (WID-SEC-2026-3441)
vuldb·2026-09-17·CVSS 4.9
CVE-2026-73445 [MEDIUM] Arista EOS up to 4.36.0.1F gRPC Network Security Interface input validation (WID-SEC-2026-3441)
A vulnerability was found in Arista EOS up to 4.36.0.1F. It has been declared as problematic. Impacted is an unknown function of the component gRPC Network Security Interface. Executing a manipulation can lead to improper input validation.
This vulnerability is handled as CVE-2026-73445. The attack can be executed remotely. There is not any exploit available.
It is recommended to upgrade the affected component.
GHSA
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to
ghsa_unreviewed·2026-09-16
CVE-2026-73445 [MEDIUM] CWE-20 On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-16
Published