{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73445", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-08-12T16:42:47.920Z", "datePublished": "2026-09-16T08:58:51.242Z", "dateUpdated": "2026-09-16T10:13:37.145Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-16T10:13:37.145Z"}, "title": "Security Advisory 0167", "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.</p><p>This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "defaultStatus": "unaffected", "versions": [{"version": "4.36.0F", "lessThanOrEqual": "4.36.0.1F", "status": "affected", "versionType": "custom"}, {"version": "4.35.0F", "lessThanOrEqual": "4.35.5M", "status": "affected", "versionType": "custom"}, {"version": "4.34.0F", "lessThanOrEqual": "4.34.7M", "status": "affected", "versionType": "custom"}, {"version": "4.33.0F", "lessThanOrEqual": "4.33.8M", "status": "affected", "versionType": "custom"}, {"version": "4.32.0F", "lessThan": "4.33.0F", "status": "affected", "versionType": "custom"}, {"version": "4.31.0F", "lessThan": "4.32.0F", "status": "affected", "versionType": "custom"}], "platforms": ["710 Series", "720D Series", "720XP/722XPM Series", "750X Series", "7010TX Series", "7020R/R4 Series", "7130 Series running EOS", "7170 Series", "7050X3/X4 Series", "7060X/X2/X4/X5/X6 Series", "7260X/X3 Series", "7280R/R2/R3/R4 Series", "7300X/X3 Series", "7320X Series", "7358X4 Series", "7368X4 Series", "7388X5 Series", "7500R/R2/R3 Series", "7800R3/R4 Series", "7700R4 Series", "AWE 5000 Series", "AWE 7200R Series", "CloudEOS", "cEOS-lab", "vEOS-lab"]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-73445, gNSI Authz must be configured on an OpenConfig gRPC transport:\n\n switch#show man api gnsi\n Transport: default\n Transport enabled: yes\n Server: running on port 6030, in default VRF\n\n Acctz enabled: no\n Attestz enabled: no\n Authz enabled: yes\n Certz enabled: no\n Credentialz enabled: no\n Enrollz enabled: no\n Pathz enabled: no", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-73445, gNSI Authz must be configured on an OpenConfig gRPC transport:</p><pre>switch#show man api gnsi\nTransport: default\nTransport enabled: yes\nServer: running on port 6030, in default VRF\n\nAcctz enabled: no\nAttestz enabled: no\nAuthz enabled: yes\nCertz enabled: no\nCredentialz enabled: no\nEnrollz enabled: no\nPathz enabled: no</pre>"}]}], "workarounds": [{"lang": "en", "value": "1. Include exactly one UploadRequest in a gNSI Authz Rotate request.\n\n2. Use a gNSI Authz policy that restricts gNSI Authz use to only those who strictly need it. Below is an example policy that only allows user \"Neo\" to rotate Authz policies:\n\n {\n \"name\":\"restrict-authz-policy\",\n \"allow_rules\":[\n {\n \"name\":\"neoallow\",\n \"request\":{\n \"paths\":[\n \"/gnsi.authz.v1.Authz/Rotate\"\n ],\n \"headers\":[\n {\n \"key\":\"username\",\n \"values\":[\n \"Neo\"\n ]\n }\n ]\n }\n },\n {\n \"name\":\"allow-gnmi\",\n \"request\":{\n \"paths\":[\n \"/gnmi.gNMI/*\"\n ]\n }\n },\n {\n \"name\":\"allow-gnoi\",\n \"request\":{\n \"paths\":[\n \"/gnoi.*\"\n ]\n }\n }\n ]\n }\n\nIdeally, this policy would be uploaded via a gNSI client for correct version and created-on metadata handling. However, the policy can also be written directly to the active policy file:\n\n switch#bash timeout 100 echo \"{\\\"name\\\":\\\"restrict-authz-policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"neoallow\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnsi.authz.v1.Authz\\/Rotate\\\"],\\\"headers\\\":[{\\\"key\\\":\\\"username\\\",\\\"values\\\":[\\\"Neo\\\"]}]}},{\\\"name\\\":\\\"allow-gnmi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnmi.gNMI\\/*\\\"]}},{\\\"name\\\":\\\"allow-gnoi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnoi.*\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json && sleep 11", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>1. Include exactly one UploadRequest in a gNSI Authz Rotate request.</p><p>2. Use a gNSI Authz policy that restricts gNSI Authz use to only those who strictly need it. Below is an example policy that only allows user &quot;Neo&quot; to rotate Authz policies:</p><pre>{\n \"name\":\"restrict-authz-policy\",\n \"allow_rules\":[\n {\n \"name\":\"neoallow\",\n \"request\":{\n \"paths\":[\n \"/gnsi.authz.v1.Authz/Rotate\"\n ],\n \"headers\":[\n {\n \"key\":\"username\",\n \"values\":[\n \"Neo\"\n ]\n }\n ]\n }\n },\n {\n \"name\":\"allow-gnmi\",\n \"request\":{\n \"paths\":[\n \"/gnmi.gNMI/*\"\n ]\n }\n },\n {\n \"name\":\"allow-gnoi\",\n \"request\":{\n \"paths\":[\n \"/gnoi.*\"\n ]\n }\n }\n ]\n}</pre><p>Ideally, this policy would be uploaded via a gNSI client for correct version and created-on metadata handling. However, the policy can also be written directly to the active policy file:</p><pre>switch#bash timeout 100 echo \"{\\\"name\\\":\\\"restrict-authz-policy\\\",\\\"allow_rules\\\":[{\\\"name\\\":\\\"neoallow\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnsi.authz.v1.Authz\\/Rotate\\\"],\\\"headers\\\":[{\\\"key\\\":\\\"username\\\",\\\"values\\\":[\\\"Neo\\\"]}]}},{\\\"name\\\":\\\"allow-gnmi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnmi.gNMI\\/*\\\"]}},{\\\"name\\\":\\\"allow-gnoi\\\",\\\"request\\\":{\\\"paths\\\":[\\\"\\/gnoi.*\\\"]}}]}\" | sudo tee /persist/sys/gnsi/authz/policy.json &amp;&amp; sleep 11</pre>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73445 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.</p><p>CVE-2026-73445 has been fixed in the following releases:</p><ul><li>4.36.1F and later releases in the 4.36.x train</li><li>4.35.6M and later releases in the 4.35.x train</li><li>4.34.8M and later releases in the 4.34.x train</li><li>4.33.9M and later releases in the 4.33.x train</li></ul><p>No hotfix is available for this issue.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24723-security-advisory-0167", "name": "Security Advisory 0167", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0167", "defects": ["BUG 1602625"], "discovery": "INTERNAL"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["710 Series", "720D Series", "720XP/722XPM Series", "750X Series", "7010TX Series", "7020R/R4 Series", "7130 Series running EOS", "7170 Series", "7050X3/X4 Series", "7060X/X2/X4/X5/X6 Series", "7260X/X3 Series", "7280R/R2/R3/R4 Series", "7300X/X3 Series", "7320X Series", "7358X4 Series", "7368X4 Series", "7388X5 Series", "7500R/R2/R3 Series", "7800R3/R4 Series", "7700R4 Series", "AWE 5000 Series", "AWE 7200R Series", "CloudEOS", "cEOS-lab", "vEOS-lab"], "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.36.0.1F", "status": "affected", "version": "4.36.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.35.5M", "status": "affected", "version": "4.35.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.34.7M", "status": "affected", "version": "4.34.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.33.8M", "status": "affected", "version": "4.33.0F", "versionType": "custom"}, {"lessThan": "4.33.0F", "status": "affected", "version": "4.32.0F", "versionType": "custom"}, {"lessThan": "4.32.0F", "status": "affected", "version": "4.31.0F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."}], "id": "CVE-2026-73445", "lastModified": "2026-09-16T11:16:42.690", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}]}, "published": "2026-09-16T09:17:04.853", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24723-security-advisory-0167"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{}