On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled." } ] } ], "references": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153", "name": "Arista Security Advisory 0153", "tags": [ "vendor-advisory" ] } ], "configurations": [ { "lang": "en", "value": "In order to be vulnerable to CVE-2026-73465, the following condition must be met:\n\n\n\nMgmtSecuritySslCertKey trace levels 0, 3 and/or 4, on agent ConfigAgent, must be enabled.\n\n\n\nswitch# show trace ConfigAgent | grep MgmtSecuritySslCertKey MgmtSecuritySslCertKey enabled 01.34......\n\n\n \n\n\n\nIf MgmtSecuritySslCertKey traces levels 0, 3 and 4 are disabled, there is no exposure to this issue and the message will look something like:\n\n\n\nswitch# show trace ConfigAgent | grep MgmtSecuritySslCertKey MgmtSecuritySslCertKey enabled ...........", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "
To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\n
" } ] } ], "workarounds": [ { "lang": "en", "value": "This vulnerability may lead to exposed private keys on log files. As such, the following messages may appear at /var/log/agents/ConfigAgent-*:\n\n\n\n2026-05-07 02:42:18.537932 18813 MgmtSecuritySslCertK 3 validateRsaPrivateKey start: -----BEGIN RSA PRIVATE KEY-----\n\n\n \n\n\n\n2026-05-07 02:42:18.537932 18813 MgmtSecuritySslCertK 3 _getPemCount start: -----BEGIN EC PRIVATE KEY-----\n\n\n \n\n\n\nThese messages can be found with the following grep command, when run from the bash shell:\n\n\n\nswitch# grep \"MgmtSecuritySslCertK\" /var/log/agents/ConfigAgent-* | grep \"PRIVATE KEY---\"", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "In order to be vulnerable to CVE-2026-73465, the following condition must be met:
MgmtSecuritySslCertKey trace levels 0, 3 and/or 4, on agent ConfigAgent, must be enabled.
switch# show trace ConfigAgent | grep MgmtSecuritySslCertKey MgmtSecuritySslCertKey enabled 01.34......\nIf MgmtSecuritySslCertKey traces levels 0, 3 and 4 are disabled, there is no exposure to this issue and the message will look something like:
switch# show trace ConfigAgent | grep MgmtSecuritySslCertKey MgmtSecuritySslCertKey enabled ...........
" } ] } ], "solutions": [ { "lang": "en", "value": "CVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "This vulnerability may lead to exposed private keys on log files. As such, the following messages may appear at /var/log/agents/ConfigAgent-*:
2026-05-07 02:42:18.537932 18813 MgmtSecuritySslCertK 3 validateRsaPrivateKey start: -----BEGIN RSA PRIVATE KEY-----\n2026-05-07 02:42:18.537932 18813 MgmtSecuritySslCertK 3 _getPemCount start: -----BEGIN EC PRIVATE KEY-----\nThese messages can be found with the following grep command, when run from the bash shell:
switch# grep \"MgmtSecuritySslCertK\" /var/log/agents/ConfigAgent-* | grep \"PRIVATE KEY---\"
\nCVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.\n" } ] } ], "source": { "advisory": "Security Advisory 0153", "discovery": "INTERNAL", "defects": [ "BUG 1595862", "BUG 1966285 (DMF)" ] }, "x_generator": { "engine": "Vulnogram 1.0.5" }, "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "HIGH", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.3, "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H" } }, { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6, "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H" } } ] }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-09-16T03:57:04.010625Z", "id": "CVE-2026-73465", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-17T11:57:21.646Z" } } ] } }