Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-73451

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can

Medium6.3EPSS 0.23%
Published
Updated
Reserved
Assigned by
Arista

Description

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Scores

CVSS scores of CVE-2026-73451, by who scored it
Scored byCVSSScoreVector
AristaCNA (assigner)4.0Medium6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
AristaCNA (assigner)3.1Medium4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
NVDNVD · Awaiting Analysis4.0Medium6.3CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.23% · top 86% of all CVEs (7 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.

Weakness

Affected products

  • Arista Networks · EOS

    • affected 4.36.0 – ≤ 4.36.0.1F
    • affected 4.35.0 – ≤ 4.35.4M
    • affected 4.34.0 – ≤ 4.34.6M
    • affected 4.33.0 – ≤ 4.33.8M
    • affected 4.32.0 – ≤ 4.32.11M
    • affected 4.31.1F – ≤ 4.31.10M

What to do

Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73451 has been fixed in the following releases: * 4.36.1F and later releases in the 4.36.x train. * 4.35.5M and later releases in the 4.35.x train. * 4.34.7M and later releases in the 4.34.x train. * 4.33.9M and later releases in the 4.33.x train.

Workaround: The workaround is to re-configure (remove and reapply) the ingress IPv4 and IPv6 ACLs applied to all SVIs. For every SVI check the active ACL(s) applied to it, switch(config)# interface VlanNNN switch(config-if-VlNNN)# show active   Then remove the ACL(s) and re-apply them, switch(config-if-VlNNN)# no ip access-group <acl name> in switch(config-if-VlNNN)# ip access-group <acl name> in switch(config-if-VlNNN)# no ipv6 access-group <acl name> in switch(config-if-VlNNN)# ipv6 access-group <acl name> in   Note: the security provided by the ACL configuration will not be present during the removal/reapplication of the security ACLs. For more information about Security ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .

References (1)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-73451 badge
[![CVE-2026-73451](https://trackcve.app/badge/CVE-2026-73451.svg)](https://trackcve.app/cve/CVE-2026-73451)

Record last updated .