CVE-2026-73438: On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set o | LiveThreat CVE Feed — Verisq

Login Request a demo

Medium severity · published Sep 16, 2026

CVE-2026-73438

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set o

5.3

CVSS

0.2%

EPSS

No

On KEV

Description

On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the same OSPFv3 broadcast domain can send a specially crafted set of packets that can cause the Ospf3 agent to restart unexpectedly. The crash results in the loss of all OSPFv3 adjacencies on the affected device and may disrupt routing across the broader OSPF domain until the agent recovers. This issue was reported externally by Dravanet Inc., and Arista is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Adjacent

Complexity

High

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 16% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

EO

EOS · Arista Networks

4.36.0F through 4.36.1F; 4.35.0F through 4.35.5M; 4.34.0F through 4.34.7M; 4.33.0F through 4.33.9M; 1.0.0 before 4.33.0F · source: vendor

Affected product

EO

EOS

Arista Networks

References

https://nvd.nist.gov/vuln/detail/CVE-2026-73438

https://www.cve.org/CVERecord?id=CVE-2026-73438

https://www.arista.com/en/support/advisories-notices/security-advisory/24728-security-advisory-0172

More from EOS

5.8

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

10.0

Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

10.0

An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS

9.6

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat

9.6

On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).