Arista EOS Vulnerability Allows Remote Code Execution via gRPC Interface
CVE-2026-73456

9.2CRITICAL

Key Information:

Vendor

Arista Networks

Status
Eos
Vendor
CVE Published:
16 September 2026

What is CVE-2026-73456?

A security vulnerability in Arista EOS could allow an unauthenticated client using the gRPC Network Packet Sampling Interface (gNPSI) to send crafted requests, potentially enabling arbitrary code execution. This flaw poses a significant risk as it grants attackers the ability to gain full administrative control over compromised switches, leading to unauthorized access and manipulation of network resources.

Affected Version(s)

EOS 710 Series 4.36.0 <= 4.36.1F

EOS 710 Series 4.35.0 <= 4.35.5M

EOS 710 Series 4.34.2F <= 4.34.7M

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered internally by Arista.
.