CVE-2026-73436

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.

On specific platforms using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.

A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces. This may result in temporary multicast traffic loss during the affected period.

On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.

On affected platforms running Arista EOS with SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this information could use it for unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the NMS.

On affected platforms running Arista EOS with OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.

On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.

On affected platforms running Arista EOS, an authenticated user with access to gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation.