CVE-2026-73450

published 2026-09-16

CVE-2026-73450: On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection…

Priority P3 35 medium 6.9 CVSS 3.1

AV A AC H PR N UI N S C C N I L A H

On affected platforms running Arista EOS with MLAG Dual Primary Detection configured, an unauthenticated attacker with access to the Dual Primary Detection network segment can send specially crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails while these packets are present, the secondary switch incorrectly concludes it is in a dual-primary condition and err-disables its interfaces, leading to a traffic interruption.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
arista_networks	eos	>= 0.0.0 < 4.33.0	4.33.0
arista_networks	eos	4.33.0 – 4.33.9M	—
arista_networks	eos	4.34.0 – 4.34.7.1M	—
arista_networks	eos	4.35.0 – 4.35.5M	—
arista_networks	eos	4.36.0 – 4.36.1F	—

CVSS provenance

nvd v3.1 6.9 MEDIUM CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:H

nvd v4.0 7.0 HIGH CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-345