Vulnerability in Arista Networks Eos
CVE-2026-73440
On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS). This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
CVSS v3 metric
CVSS v3 base score 4.2 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.
Affected products
Weakness classification (CWE)
References
- psirt@arista.com (vendor-advisory)
Frequently asked questions
- What is CVE-2026-73440?
- CVE-2026-73440 is a medium-severity vulnerability in Arista Networks Eos, classified under Improper Removal of Sensitive Information Before Storage or Transfer. CVSS score: 4.2/10. Published 2026-09-16.
- How severe is CVE-2026-73440?
- Medium severity. CVSS v3 base score is 4.2 out of 10.