CVE-2026-73444

Medium

Description

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.

SeverityMedium

CVSS4.7

Exploit probability—

ProductEOS

PublishedSep 15, 2026

First seenSep 15, 2026

Weakness typeCWE-303CWE-303

How to fix

Vendor advisories

arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157

Affected products

Product	Affected versions	Fixed in
Arista Networks EOS	4.36.0 ≤ v ≤ 4.36.1F, 4.35.0 ≤ v ≤ 4.35.5M, 4.34.0 ≤ v ≤ 4.34.7M, 4.33.0 ≤ v ≤ 4.33.9M, 0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.