01 Record
CVE-2026-73453
Security Advisory 0174
CriticalPUBLISHEDCNA: Arista
CNA base score9.5 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
02 Description
Security Advisory 0174
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Not recorded
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-16 09:46Z50 MIN AGO
- Last updated
- 2026-09-16 10:13Z23 MIN AGO
- Reserved
- 2026-08-12
- Assigning CNA
- Arista
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.5)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weaknesses
- CWE-94Improper Control of Generation of Code ('Code Injection')Base
- Data version
- 5.2
- Document digest
- 2445c4e84e29ae134e801e583d8120ca960287827402a555c6d9b8e8467613a3
05 Affected products
VendorProductVersionsPlatforms
Arista NetworksEOS4.36.0F to 4.36.1F, 4.35.0F to 4.35.5M, 4.34.0F to 4.34.7M, 4.33.0F to < 4.34.0F, 4.32.0F to < 4.33.0F, 4.31.0F to < 4.32.0F, 4.30.0F to < 4.31.0F, 4.29.2F to < 4.30.0F710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance
06 References
- www.arista.comSecurity Advisory 0174https://www.arista.com/en/support/advisories-notices/security-advisory/24730-security-advisory-0174
07 Remediation
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73453 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train No hotfix is available for this issue.