01 Record

CVE-2026-73435

Security Advisory 0171

HighPUBLISHEDCNA: Arista

CNA base score7.0 CVSS v4.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

View raw JSON

02 Description

Security Advisory 0171

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: Not scored by EPSS
EPSS percentile: Not scored by EPSS
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Not recorded
Red Hat severity: No Red Hat rating. Red Hat rates the CVEs that affect its products.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-16 09:19Z1 HR AGO

Last updated

2026-09-16 10:13Z23 MIN AGO

Reserved

2026-08-12

Assigning CNA

Arista

Record state

PUBLISHED

Severity

High (CVSS 7.0)

CNA CVSS vector

CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Weaknesses

CWE-345Insufficient Verification of Data AuthenticityClass

Data version

5.2

Document digest

0ee9186235c677a6685f3c30449a1d4b3c31d776ca5b5d242135ddf9ab6bef24

05 Affected products

VendorProductVersionsPlatforms

Arista NetworksEOS4.36.0F to 4.36.1F, 4.35.0F to 4.35.5M, 4.34.0F to 4.34.7M, 4.33.0F to 4.33.9M, 1.0.0 to < 4.33.0F710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010 Series, 7010X Series, 7020R/R4 Series, 7130 Series running EOS, 7150 Series, 7160 Series, 7170 Series, 7050X/X2/X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7250X Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance

06 References

www.arista.comSecurity Advisory 0171https://www.arista.com/en/support/advisories-notices/security-advisory/24727-security-advisory-0171vendor-advisory

07 Remediation

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73435 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.7.1M and later releases in the 4.34.x train - 4.33.10M and later releases in the 4.33.x train A hotfix is available for the following releases: 4.36.1F, 4.35.5M, 4.34.7M, 4.33.9M. URL: https://www.arista.com/support/advisories-notices/sa-download/?sa171-SecurityAdvisory171_CVE-2026-73435.swix SWIX hash (SHA512): 4c4ff053d8165f347b45dfcafc2d20396e3eb00869b0088f3128be7f53b2a028b479fa8279849c800b5916ab9aaf8077718a68e3bf4277d55b44076650de0aa7 Note: Installing/uninstalling the SWIX will cause the Ospf process to restart.