CVE-2026-73443

Medium

Description

On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 network segment on which VRRP is running can capture a legitimate authenticated VRRP advertisement and replay it indefinitely. Replayed advertisements can be used to advertise stale VRRP state, for example to prevent a backup router from taking over the virtual gateway after the original master has gone down, resulting in a denial of service for hosts using the virtual gateway address.

SeverityMedium

CVSS4.7

Exploit probability—

ProductEOS

PublishedSep 16, 2026

First seenSep 16, 2026

Weakness typeCWE-294CWE-294

How to fix

Vendor advisories

arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157

Affected products

Product	Affected versions	Fixed in
Arista Networks EOS	4.36.0 ≤ v ≤ 4.36.1F, 4.35.0 ≤ v ≤ 4.35.5M, 4.34.0 ≤ v ≤ 4.34.7M, 4.33.0 ≤ v ≤ 4.33.9M	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.