CVE-2026-2380

On affected platforms running Arista EOS with IGMP snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, the gNPSI client credentials might be logged in clear text in local or remote accounting logs to authenticated users.

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down.

On Arista EOS platforms with VRRP enabled, peer device VRRP authentication credentials are logged in cleartext. An authenticated user with sufficient privileges can read these credentials from agent trace logs or from a system receiving forwarded log output, without access to the network segment running VRRP.

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.

Arista EOS versions before 4.11.12, 4.12 before 4.12.11, 4.13 before 4.13.14M, 4.14 before 4.14.5FX.5, and 4.15 before 4.15.0FX1.1 allow remote attackers to execute arbitrary code as root by leveraging management-plane access.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

An unauthenticated P4Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. By crafting a malicious packet during session initiation, an attacker can obtain complete administrative control over the switch.

A privileged attacker can exploit gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.