Arista Networks Eos vulnerabilities

CVE-2026-7473 [MEDIUM] CWE-1023 CVE-2026-7473: On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (V On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation

CVE-2026-73456 [CRITICAL] CWE-94 CVE-2026-73456: Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampli Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

CVE-2026-73453 [CRITICAL] CWE-94 CVE-2026-73453: An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session

CVE-2026-73464 [HIGH] CWE-94 CVE-2026-73464: On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a sp On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.

CVE-2026-73447 [CRITICAL] CWE-78 CVE-2026-73447: A privileged attacker can exploit certain operation to execute arbitrary commands with root privileg A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. Th

CVE-2024-27890 [CRITICAL] CWE-306 CVE-2024-27890: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVE-2026-73437 [CRITICAL] CWE-345 CVE-2026-73437: On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay confi On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could al

CVE-2026-73454 [HIGH] CWE-77 CVE-2026-73454: On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz con On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.

CVE-2024-27892 [CRITICAL] CWE-306 CVE-2024-27892: Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch.

CVE-2021-28506 [CRITICAL] CWE-285 CVE-2021-28506: An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authori An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.

CVE-2026-73439 [HIGH] CWE-842 CVE-2026-73439: On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on t On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain

CVE-2025-1260 [CRITICAL] CWE-284 CVE-2025-1260: On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unexpected configuration/operations being applied to the switch.

CVE-2026-73461 [HIGH] CWE-266 CVE-2026-73461: On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

CVE-2026-73458 [HIGH] CWE-303 CVE-2026-73458: On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

CVE-2026-73435 [HIGH] CWE-345 CVE-2026-73435: On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured On affected platforms running Arista EOS with Open Shortest Path First version 2 (OSPFv2) configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

CVE-2024-9448 [HIGH] CWE-1284 CVE-2024-9448: On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cau On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to hit Traffic Policy rules that they are expected to hit. If the rule was to drop the packet, the packet will not be dropped and instead will be forwarded as if the rule was not in place. This could lead to packets being

CVE-2026-73455 [HIGH] CWE-130 CVE-2026-73455: On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

CVE-2025-6188 [HIGH] CWE-290 CVE-2025-6188: On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may b On affected platforms running Arista EOS, maliciously formed UDP packets with source port 3503 may be accepted by EOS. UDP Port 3503 is associated with LspPing Echo Reply. This can result in unexpected behaviors, especially for UDP based services that do not perform some form of authentication.

CVE-2025-8873 [HIGH] CWE-1286 CVE-2025-8873: On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec

CVE-2021-28505 [HIGH] CWE-284 CVE-2021-28505: On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applie On affected Arista EOS platforms, if a VXLAN match rule exists in an IPv4 access-list that is applied to the ingress of an L2 or an L3 port/SVI, the VXLAN rule and subsequent ACL rules in that access list will ignore the specified IP protocol.