CVE-2026-73464 — Security Advisory 0166

Back Back to CVE browser

HIGH

Security Advisory 0166

Published Sep 16, 2026

8.7

HIGH

CVSS 4.0

EPSS 0.64%

Description

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch.

Affected products

Vendor Arista Networks Product EOS Default
unaffected
- Version
  4.29.0F
  Status
  affected
  Constraints
  <4.30.0F
- Version
  4.30.0F
  Status
  affected
  Constraints
  <4.31.0F
- Version
  4.31.0F
  Status
  affected
  Constraints
  <4.32.0F
- Version
  4.32.0F
  Status
  affected
  Constraints
  <4.33.0F
- Version
  4.33.0F
  Status
  affected
  Constraints
  <=4.33.8M
- Version
  4.34.0F
  Status
  affected
  Constraints
  <=4.34.7M
- Version
  4.35.0F
  Status
  affected
  Constraints
  <=4.35.5M
- Version
  4.36.0F
  Status
  affected
  Constraints
  <=4.36.0.1F

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Arista Networks

EOS

unaffected

Version	Status	Constraints
4.29.0F	affected	<4.30.0F
4.30.0F	affected	<4.31.0F
4.31.0F	affected	<4.32.0F
4.32.0F	affected	<4.33.0F
4.33.0F	affected	<=4.33.8M
4.34.0F	affected	<=4.34.7M
4.35.0F	affected	<=4.35.5M
4.36.0F	affected	<=4.36.0.1F

Remediation

Vendor solution

The following EOS releases contain the fix for this vulnerability: - 4.33.9M and later releases in the 4.33.x train - 4.34.7.1M and later releases in the 4.34.x train - 4.35.6M and later releases in the 4.35.x train - 4.36.1F and later releases in the 4.36.x train

No hotfix is available for this vulnerability.