Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
  • Support the projectPage
Back

CVE-2026-73449

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADI

Description

On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADIUS proxy client can prevent RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Requests as defined in RFC 5176, from being applied to locally authenticated 802.1X sessions. This allows an endpoint session that a RADIUS server or network access control system has ordered disconnected to remain authorized on the network. Both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization must be explicitly configured for a deployment to be exposed to this issue. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Timeline

  1. ID reserved

    By Arista

  2. · 33 days later

    Published

  3. · 1 day later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-73449, by who scored it
Scored byCVSSScoreVector
AristaCNA (assigner)4.0Medium5.9CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L
AristaCNA (assigner)3.1Medium5.9CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
NVDNVD · Awaiting Analysis4.0Medium5.9CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.24% · top 85% of all CVEs (10 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Affected products

  • Arista Networks · EOS

    • affected 4.36.0 – ≤ 4.36.1F
    • affected 4.35.0 – ≤ 4.35.5M
    • affected 4.34.0 – ≤ 4.34.7.1M

What to do

Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73449 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train

Workaround: If the RADIUS proxy dynamic authorization function is not operationally required, disabling it removes the exposure. Please note this operation will stop the switch from forwarding CoA and Disconnect requests to downstream RADIUS proxy clients. Dynamic authorization of the switch's own local 802.1X sessions continues to work. switch(config)# radius proxy switch(config-radius-proxy)# no dynamic-authorization If RADIUS proxy dynamic authorization must remain enabled, the exposure window can be reduced (but not eliminated) by lowering the proxy client session idle timeout from its default of 600 seconds: switch(config)# radius proxy switch(config-radius-proxy)# client session idle-timeout <seconds> seconds Note that if the idle-timeout is being reduced, then radius proxy clients should increase the frequency of interim-update accounting requests. For more information about idle-timeout configuration see “Configuring session idle-timeout” section in RADIUS Proxy. If a specific endpoint must be forcibly disconnected while this issue is unresolved, the following command can be used. switch(config)# clear dot1x host mac <endpoint macAddress>

References

1

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-73449 badge
[![CVE-2026-73449](https://cveledger.app/badge/CVE-2026-73449.svg)](https://cveledger.app/cve/CVE-2026-73449)

Record last updated .