What is CVE-2026-73454?

CVE-2026-73454 is a high-severity vulnerability in Arista Networks Eos, classified under Command Injection. CVSS score: 8.1/10. Published 2026-09-16.

How severe is CVE-2026-73454?

High severity. CVSS v3 base score is 8.1 out of 10.

RCE in Arista Networks Eos

CVE-2026-73454

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.

Vulnerability class: Command Injection (OS Command Injection)

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Arista Networks Eos

Weakness classification (CWE)

CWE-77 — Command Injection

References

psirt@arista.com (vendor-advisory)

Frequently asked questions

What is CVE-2026-73454?: CVE-2026-73454 is a high-severity vulnerability in Arista Networks Eos, classified under Command Injection. CVSS score: 8.1/10. Published 2026-09-16.
How severe is CVE-2026-73454?: High severity. CVSS v3 base score is 8.1 out of 10.