CVE-2026-73462: Arista Networks Eos

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.

Affected products

• Arista Networks Eos: from 4.36.0, up to and including 4.36.1F; from 4.35.0, up to and including 4.35.5M; from 4.34.0, up to and including 4.34.7.1M; from 4.33.0, up to and including 4.33.8M

Published 2026-09-16. Last modified 2026-09-17.