CVE-2026-73440
MediumCVSS 4.2Summary
On affected platforms running Arista EOS with SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this information could use it for unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the NMS.
Risk Assessment
Exposure of SNMPv3 keys may allow unauthorized reading of management data and sending fraudulent notifications to the monitoring system. This can lead to leakage of infrastructure information and disruption of monitoring.
Recommendation
Apply Arista EOS fixes and restrict access to device configuration to essential personnel. Consider rotating SNMPv3 credentials after the update.
Other vulnerabilities in Arista EOS
See all- CVE-2026-77190Medium
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.
- CVE-2026-73469Medium
On specific platforms using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.
- CVE-2026-73468Medium
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces. This may result in temporary multicast traffic loss during the affected period.
- CVE-2026-73455High
On affected platforms running Arista EOS with OSPFv3 configured, a specially crafted packet can cause the OSPFv3 agent to restart unexpectedly.
- CVE-2026-73438Medium
On affected platforms running Arista EOS with OSPFv3 configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers.
- CVE-2026-73436Medium
On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.
- CVE-2026-73435High
On affected platforms running Arista EOS with OSPFv2 configured, a specially crafted OSPFv2 packet from an unauthenticated attacker on the same broadcast segment, with OSPFv2 authentication configured, can cause adjacency flapping and packet loss. The disruption can affect routing across the broader OSPF domain.
- CVE-2026-19640Medium
On affected platforms running Arista EOS, an authenticated user with access to gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.
- CVE-2026-73464High
On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.
- CVE-2026-73463Medium
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation.
Original NVD description (English source)
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS). This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.