CVE-2026-73446: Arista Networks Eos

High severity, CVSS 7.4. EPSS: 0.3% chance of exploitation in the next 30 days.

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

Affected products

• Arista Networks Eos: from 4.36.0, up to and including 4.36.1F; from 4.35.0, up to and including 4.35.5M; from 4.34.0, up to and including 4.34.7.1M; from 4.33.0, up to and including 4.33.9M; from 4.32.0, before 4.33.0F (fixed in 4.33.0F); from 4.31.0, before 4.32.0F (fixed in 4.32.0F)

Published 2026-09-16. Last modified 2026-09-16.