01 Record
CVE-2026-73438
Security Advisory 0172
HighPUBLISHEDCNA: Arista
CNA base score7.0 CVSS v4.0CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
02 Description
Security Advisory 0172
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Not recorded
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-16 09:38Z58 MIN AGO
- Last updated
- 2026-09-16 10:13Z23 MIN AGO
- Reserved
- 2026-08-12
- Assigning CNA
- Arista
- Record state
- PUBLISHED
- Severity
- High (CVSS 7.0)
- CNA CVSS vector
- CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
- Weaknesses
- CWE-617Reachable AssertionBase
- Data version
- 5.2
- Document digest
- 2853cfe07abb32609ea3172052d9bd90ed93ce755bc35938af26759a54880f97
05 Affected products
VendorProductVersionsPlatforms
Arista NetworksEOS4.36.0F to 4.36.1F, 4.35.0F to 4.35.5M, 4.34.0F to 4.34.7M, 4.33.0F to 4.33.9M, 1.0.0 to < 4.33.0F710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance
06 References
- www.arista.comSecurity Advisory 0172https://www.arista.com/en/support/advisories-notices/security-advisory/24728-security-advisory-0172
07 Remediation
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73438 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train - 4.33.10M and later releases in the 4.33.x train No hotfix is available for this issue.