On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can
Summary
| CVE | CVE-2026-73451 |
|---|---|
| State | PUBLISHED |
| Assigner | Arista |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-15 19:17:38 UTC |
| Updated | 2026-09-16 19:08:50 UTC |
| Description | On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks. |
Risk And Classification
Primary CVSS: v4.0 6.3 MEDIUM from [email protected]
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.001770000 probability, percentile 0.075190000 (date 2026-09-16)
Problem Types: CWE-1419 CWE-1419 Incorrect Initialization of Resource
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 6.3 | MEDIUM | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| 3.1 | [email protected] | Secondary | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| 3.1 | CNA | CVSS | 4.8 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS v3.1 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Arista Networks | EOS | affected 4.36.0 4.36.0.1F custom | 755 Series, 758 Series |
| CNA | Arista Networks | EOS | affected 4.35.0 4.35.4M custom | 755 Series, 758 Series |
| CNA | Arista Networks | EOS | affected 4.34.0 4.34.6M custom | 755 Series, 758 Series |
| CNA | Arista Networks | EOS | affected 4.33.0 4.33.8M custom | 755 Series, 758 Series |
| CNA | Arista Networks | EOS | affected 4.32.0 4.32.11M custom | 755 Series, 758 Series |
| CNA | Arista Networks | EOS | affected 4.31.1F 4.31.10M custom | 755 Series, 758 Series |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.arista.com/en/support/advisories-notices/security-advisory/24707-securit... | [email protected] | www.arista.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Additional Advisory Data
Solutions
CNA: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73451 has been fixed in the following releases: * 4.36.1F and later releases in the 4.36.x train. * 4.35.5M and later releases in the 4.35.x train. * 4.34.7M and later releases in the 4.34.x train. * 4.33.9M and later releases in the 4.33.x train.
Workarounds
CNA: The workaround is to re-configure (remove and reapply) the ingress IPv4 and IPv6 ACLs applied to all SVIs. For every SVI check the active ACL(s) applied to it, switch(config)# interface VlanNNN switch(config-if-VlNNN)# show active Then remove the ACL(s) and re-apply them, switch(config-if-VlNNN)# no ip access-group <acl name> in switch(config-if-VlNNN)# ip access-group <acl name> in switch(config-if-VlNNN)# no ipv6 access-group <acl name> in switch(config-if-VlNNN)# ipv6 access-group <acl name> in Note: the security provided by the ACL configuration will not be present during the removal/reapplication of the security ACLs. For more information about Security ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .