Critical severity · published Sep 16, 2026
CVE-2026-73453
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS
10.0
CVSS
0.7%
EPSS
No
On KEV
Description
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EO
EOS · Arista Networks
4.36.0F through 4.36.1F; 4.35.0F through 4.35.5M; 4.34.0F through 4.34.7M; 4.33.0F before 4.34.0F; 4.32.0F before 4.33.0F; 4.31.0F before 4.32.0F; +2 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-73453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-73453
www.arista.com
https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174
More from EOS
5.8
CVE-2026-7473
Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
10.0
CVE-2026-73456
Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
9.6
CVE-2026-73437
On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat
9.6
CVE-2024-27892
On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled).
9.6
CVE-2024-27890
On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled).