Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-73439

Security Advisory 0164

CVSS 3.1 7.5 HIGHCVSS 4.0 7.7 HIGHCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73439

Published

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73439

Published

EOS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Arista Networks",
                    "product": "EOS",
                    "platforms": [
                        "710 Series",
                        "720D Series",
                        "720XP/722XPM Series",
                        "750X Series",
                        "7010TX Series",
                        "7020R/R4 Series",
                        "7130 Series (EOS)",
                        "7170 Series",
                        "7050X3/X4 Series",
                        "7060X/X2/X4/X5/X6 Series",
                        "7260X/X3 Series",
                        "7280R/R2/R3/R4 Series",
                        "7300X/X3 Series",
                        "7320X Series",
                        "7358X4 Series",
                        "7368X4 Series",
                        "7388X5 Series",
                        "7500R/R2/R3 Series",
                        "7800R3/R4 Series",
                        "7700R4 Series",
                        "AWE 5000 Series",
                        "AWE 7200R Series",
                        "CloudEOS",
                        "cEOS-lab",
                        "vEOS-lab",
                        "CloudVision eXchange"
                    ],
                    "versions": [
                        {
                            "version": "4.33.2F",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThanOrEqual": "4.33.8M"
                        },
                        {
                            "version": "4.34.0F",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThanOrEqual": "4.34.6M"
                        },
                        {
                            "version": "4.35.0F",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThanOrEqual": "4.35.5M"
                        },
                        {
                            "version": "4.36.0F",
                            "status": "affected",
                            "versionType": "custom",
                            "lessThanOrEqual": "4.36.0.1F"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON