CVE-2026-73458

HighCVSS 8.2/10Last modified Sep 16, 2026

Description

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-303

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-734597.4On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDUCVE-2026-73468.1Inappropriate implementation in Tint in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to perform out of bounds memory acceCVE-2026-734606.1On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LCVE-2026-734618.0On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig mayCVE-2026-734626.5On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANsCVE-2026-734635.3On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition iCVE-2026-734648.8On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a maCVE-2026-734656.3On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files durinCVE-2026-734666.3On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operaCVE-2026-734676.3On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller AccCVE-2026-734686.5A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temCVE-2026-734695.8When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be s
CVE-2026-73458: High severity, CVSS 8.2 | Vulnix