Vulnerability in Arista EOS Affects TACACS+ Server Configurations
CVE-2026-73467

6MEDIUM

Key Information:

Vendor

Arista Networks

Status
Eos
Vendor
CVE Published:
15 September 2026

What is CVE-2026-73467?

A vulnerability in Arista EOS allows the exposure of plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers under specific conditions. This poses a risk as unauthorized users may gain access to sensitive authentication data. Administrators are advised to review their configurations and apply necessary updates as detailed in the vendor's security advisory to mitigate potential risks.

Affected Version(s)

EOS 4.36.0 <= 4.36.1F

EOS 4.35.0 <= 4.35.4M

EOS 4.34.0 <= 4.34.7M

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.