CVE-2026-73436

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

On affected platforms running Arista EOS with OSPFv2 and OSPFv2 segment routing configured, a specially crafted OSPFv2 packet from an adjacent OSPF neighbor may cause OSPF to restart unexpectedly.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-125CWE-1284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Arista NetworksEOS>= 4.36.0F, <= 4.36.1F; >= 4.35.0F, <= 4.35.5M; >= 4.34.0F, <= 4.34.7.1M; >= 4.33.0F, <= 4.33.9M; >= 1.0.0, < 4.33.0F

References

Timeline

Published
Sep 16, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-734379.6On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with CVE-2026-734385.3On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the samCVE-2026-734397.5On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configurCVE-2026-73448.8Use after free in Accessibility in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderCVE-2026-734404.2On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials CVE-2026-734423.0On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the sCVE-2026-734434.7On affected platforms running Arista EOS with VRRPv2 IP-AH authentication configured, an unauthenticated attacker within the same layer 2 neCVE-2026-734444.7On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attackerCVE-2026-734454.9On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect ACVE-2026-734467.4On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-ICVE-2026-734479.1A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. ACVE-2026-734495.9On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authoriza
CVE-2026-73436: Medium severity, CVSS 6.5 | Vulnix