CVE-2026-73463 PUBLISHED

Security Advisory 0169

Assigner: Arista
Reserved: 12.08.2026 Published: 16.09.2026 Updated: 16.09.2026

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	None
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	High	Integrity	High	Integrity	None
Attack Requirements	Present	Availability	None	Availability	None
Privileges Required	Low
User Interaction	None

CVSS 4.0

Product Status

Vendor	Arista Networks
Product	EOS
Versions	Default: unaffected affected from 4.36.0F to 4.36.0.1F (incl.) affected from 4.35.0F to 4.35.5M (incl.) affected from 4.34.0F to 4.34.7M (incl.) affected from 4.33.0F to 4.33.8M (incl.) affected from 4.32.0F to 4.32.11M (incl.) affected from 4.31.0F to 4.31.10M (incl.)

Affected Configurations

In order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:

switch#show man api gnsi Transport: default Transport enabled: yes Server: running on port 6030, in default VRF

Transport: other Transport enabled: yes Server: running on port 6031, in default VRF

Acctz enabled: no Attestz enabled: no Authz enabled: yes Certz enabled: no Credentialz enabled: no Enrollz enabled: no Pathz enabled: no

Please note that a system may have been affected by this vulnerability if a secondary transport (such as the "other" transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport.

Workarounds

Restrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.

Firstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:

switch(config)#aaa authorization commands all default local switch(config)#aaa authorization config-commands

Now restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:

switch(config-mgmt-api-gnsi)#role network-operator switch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi . 256 permit command .

Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.

CVE-2026-73463 has been fixed in the following releases: - 4.36.1F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.7.1M and later releases in the 4.34.x train - 4.33.9M and later releases in the 4.33.x train

No hotfix is available for this issue.

References

Security Advisory 0169

Problem Types

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') CWE