"}],"value":"In order to be vulnerable to CVE-2026-73467, the following condition must be met:\n\n\n\nTacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword “Tacacs”. The level from the output can be 6 or any range that includes 6, e.g. “0-7” or “*”.\n\n\n\nThis is an example showing the trace setting “Tacacs*” with level with “0-7”, which will leak the password:\n\n\n\nswitch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7"},{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Impact on DANZ Monitoring Fabric (DMF)In order to be vulnerable to CVE-2026-73467, the following condition must be met:
Tacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword “Tacacs”. The level from the output can be 6 or any range that includes 6, e.g. “0-7” or “*”.
This is an example showing the trace setting “Tacacs*” with level with “0-7”, which will leak the password:
switch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7
DANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.
DMF fabric switches running Switch Light OS are not affected by this vulnerability.
Customers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.
DMF-CONTROLLER> show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi True x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi True i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi False x86_64-ccs-720df-48y-eos"}],"value":"Impact on DANZ Monitoring Fabric (DMF)\n\nDANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.\n\n\n\nDMF fabric switches running Switch Light OS are not affected by this vulnerability.\n\n\n\nCustomers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.\n\n\n\nDMF-CONTROLLER> show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi True x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi True i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi False x86_64-ccs-720df-48y-eos"}],"datePublic":"2026-09-09T18:37:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers\n"}],"value":"On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers"}],"impacts":[{"capecId":"CAPEC-37","descriptions":[{"lang":"en","value":"CAPEC-37 Retrieve Embedded Sensitive Data"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"HIGH","attackRequirements":"NONE","attackVector":"LOCAL","baseScore":6,"baseSeverity":"MEDIUM","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"HIGH","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","userInteraction":"PASSIVE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-532","description":"CWE-532 Insertion of Sensitive Information into Log File","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-15T18:44:39.048Z","orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista"},"references":[{"name":"Arista Security Advisory 0153","tags":["vendor-advisory"],"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
\nCVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.\n"}],"value":"CVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train."}],"source":{"advisory":"Security Advisory 0153","defects":["BUG 1595862","BUG 1966285 (DMF)"],"discovery":"INTERNAL"},"title":"On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
"}],"value":"The workaround is to disable Tacacs level 6 tracing on agent Aaa.\n\n\n\nswitch(config)# no trace Aaa enable Tacacs levels 6\n\nClean Up Existing Log Files\n\nIf any of the above agent logging levels have been enabled, it’s necessary to clean up the existing log files to remove the already leaked secrets and keys.\n\n\n\nUse the following commands to clean up Aaa or ConfigAgent log files:\n\n\n\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\n\n\n \n\n\n\nThen use the following commands to clean up previously rotated old log files:\n\n\n\nswitch(config)# bash sudo find /var/log/agents -name 'Aaa*.gz' -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name 'ConfigAgent*.gz' -type f -delete"}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","assignerShortName":"Arista","cveId":"CVE-2026-73467","datePublished":"2026-09-15T18:44:39.048Z","dateReserved":"2026-08-12T16:47:18.121Z","dateUpdated":"2026-09-16T03:57:05.900Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-15 19:17:39","lastModifiedDate":"2026-09-16 04:18:40","problem_types":["CWE-532","CWE-532 CWE-532 Insertion of Sensitive Information into Log File"],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","attackRequirements":"NONE","privilegesRequired":"HIGH","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":0.3,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T00:00:00+00:00","id":"CVE-2026-73467","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"73467","Ordinal":"1","Title":"On affected platforms running Arista EOS, under certain circumst","CVE":"CVE-2026-73467","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"73467","Ordinal":"1","NoteData":"On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers","Type":"Description","Title":"On affected platforms running Arista EOS, under certain circumst"}]}}}The workaround is to disable Tacacs level 6 tracing on agent Aaa.
switch(config)# no trace Aaa enable Tacacs levels 6
Clean Up Existing Log FilesIf any of the above agent logging levels have been enabled, it’s necessary to clean up the existing log files to remove the already leaked secrets and keys.
Use the following commands to clean up Aaa or ConfigAgent log files:
switch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\nThen use the following commands to clean up previously rotated old log files:
switch(config)# bash sudo find /var/log/agents -name 'Aaa*.gz' -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name 'ConfigAgent*.gz' -type f -delete