Skip to content
OpenAdvisories
Critical · 10.0 CVE-2026-73456 EUVD-2026-81006GHSA-7g93-8r7h-w6jj

Under certain circumstances, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Published Sep 16, 2026 · Updated Sep 17, 2026 · Assigned by Arista

Vendor: Arista Networks Product: EOS Category: Network devices

Description

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Affected products

VendorProductAffectedFixed
Arista Networks EOS 4.36.0 – ≤ 4.36.1F, 4.35.0 – ≤ 4.35.5M, 4.34.2F – ≤ 4.34.7M —

Advisories 2

References