CVE-2026-73460: Arista Networks Eos

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.

Affected products

• Arista Networks Eos: from 4.36.0, up to and including 4.36.1F

Published 2026-09-16. Last modified 2026-09-16.