CVE-2026-73451On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can
- 6.3MediumCVSS base score
- 0.23%Exploitation in 30 daysEPSS · top 86% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Timeline
ID reserved
By Arista
- 34 days later
· 34 days later
Published
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| AristaCNA (assigner) | 4.0 | Medium6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| AristaCNA (assigner) | 3.1 | Medium4.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Awaiting Analysis | 4.0 | Medium6.3 | CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.23% · top 86% of all CVEs (14 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.3.
Affected products
- affected 4.36.0 – ≤ 4.36.0.1F
- affected 4.35.0 – ≤ 4.35.4M
- affected 4.34.0 – ≤ 4.34.6M
- affected 4.33.0 – ≤ 4.33.8M
- affected 4.32.0 – ≤ 4.32.11M
- affected 4.31.1F – ≤ 4.31.10M
What to do
Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73451 has been fixed in the following releases: * 4.36.1F and later releases in the 4.36.x train. * 4.35.5M and later releases in the 4.35.x train. * 4.34.7M and later releases in the 4.34.x train. * 4.33.9M and later releases in the 4.33.x train.
Workaround: The workaround is to re-configure (remove and reapply) the ingress IPv4 and IPv6 ACLs applied to all SVIs. For every SVI check the active ACL(s) applied to it, switch(config)# interface VlanNNN switch(config-if-VlNNN)# show active Then remove the ACL(s) and re-apply them, switch(config-if-VlNNN)# no ip access-group <acl name> in switch(config-if-VlNNN)# ip access-group <acl name> in switch(config-if-VlNNN)# no ipv6 access-group <acl name> in switch(config-if-VlNNN)# ipv6 access-group <acl name> in Note: the security provided by the ACL configuration will not be present during the removal/reapplication of the security ACLs. For more information about Security ACLs see EOS User Manual: ACLs and Route Maps https://www.arista.com/en/um-eos/eos-acls-and-route-maps .
References
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-79140 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-73451)Record last updated .