Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-73469

Security Advisory 0176

CVSS 3.1 5.8 MEDIUMCVSS 4.0 6.9 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-73469

Published

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-73469

Published

EOS

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Arista Networks",
                    "product": "EOS",
                    "defaultStatus": "unaffected",
                    "versions": [
                        {
                            "version": "4.35.0F",
                            "lessThanOrEqual": "4.35.4M",
                            "status": "affected",
                            "versionType": "custom"
                        }
                    ],
                    "platforms": [
                        "7050X4 Series",
                        "7358X4 Series"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON