CVE-2026-73467

MediumCVSS 6.3/10Last modified Sep 16, 2026

Description

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Arista NetworksEOS>= 4.36.0, <= 4.36.1F; >= 4.35.0, <= 4.35.4M; >= 4.34.0, <= 4.34.7M; >= 0.0.0, <= 4.33.9M; <= 4.32.0; <= 4.31.0

References

Timeline

Published
Sep 15, 2026
Last modified
Sep 16, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-734686.5A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temCVE-2026-734695.8When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be sCVE-2026-73478.1Use after free in Chromoting in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code via malicious netwCVE-2026-734709.8Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegaCVE-2026-734716.1A flaw was found in GStreamer gst-plugins-good (avidemux). In the Nikon metadata tag parser, a pointer can be dereferenced without verifyingCVE-2026-734726.1A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checksCVE-2026-734735.5A flaw was found in GStreamer gst-plugins-good (avidemux). In the subindex parser, missing validation of the entry count can cause excessiveCVE-2026-734745.3Server-Side Request Forgery (SSRF) vulnerability in Drupal Entity Share Websub allows Server Side Request Forgery. This issue affects EntityCVE-2026-734759.1Incorrect Authorization vulnerability in Drupal Commerce PayPal allows Forceful Browsing. This issue affects Commerce PayPal versions: from CVE-2026-734765.4Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects ExternCVE-2026-734775.3Incorrect Authorization vulnerability in Drupal Quick Tabs allows Forceful Browsing. This issue affects Quick Tabs versions: from 0.0.0 to 4CVE-2026-734785.3Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2