Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-73438

Security Advisory 0172

CVSS 3.1 5.3 MEDIUMCVSS 4.0 7.0 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73438

Published

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73438

Published

EOS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Arista Networks",
                    "product": "EOS",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "4.36.0F",
                            "lessThanOrEqual": "4.36.1F",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "4.35.0F",
                            "lessThanOrEqual": "4.35.5M",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "4.34.0F",
                            "lessThanOrEqual": "4.34.7M",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "4.33.0F",
                            "lessThanOrEqual": "4.33.9M",
                            "status": "affected",
                            "versionType": "custom"
                        },
                        {
                            "version": "1.0.0",
                            "lessThan": "4.33.0F",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ],
                    "platforms": [
                        "710 Series",
                        "720D Series",
                        "720XP/722XPM Series",
                        "750X Series",
                        "7010TX Series",
                        "7020R/R4 Series",
                        "7130 Series running EOS",
                        "7170 Series",
                        "7050X3/X4 Series",
                        "7060X/X2/X4/X5/X6 Series",
                        "7260X/X3 Series",
                        "7280R/R2/R3/R4 Series",
                        "7300X/X3 Series",
                        "7320X Series",
                        "7358X4 Series",
                        "7368X4 Series",
                        "7388X5 Series",
                        "7500R/R2/R3 Series",
                        "7800R3/R4 Series",
                        "7700R4 Series",
                        "AWE 5000 Series",
                        "AWE 7200R Series",
                        "CloudEOS",
                        "cEOS-lab",
                        "vEOS-lab",
                        "CloudVision eXchange, virtual or physical appliance"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON