CVE-2026-73461

Security Advisory 0163

State: Published
Severity: 9.4 Critical
Published: Sep 16, 2026
Updated: Sep 17, 2026
Reserved: Aug 12, 2026

Description

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

Scores

CVSS	Score	Vector	Source
4.0	9.4 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	Arista
3.1	8.0 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H	Arista

Weaknesses

CWE-266 Incorrect Privilege Assignment

Affected Products

Product	Versions
EOSArista Networks	4.29.0F to before 4.30.0FAffected 4.30.0F to before 4.31.0FAffected 4.31.0F to before 4.32.0FAffected 4.32.0F through 4.32.11MAffected 4.33.0F through 4.33.8MAffected 4.34.0F through 4.34.7MAffected 4.35.0F through 4.35.5MAffected 4.36.0F through 4.36.0.1FAffected

References

Arista Networks Security Advisory 0163vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.