CVE-2026-73469 PUBLISHED

Security Advisory 0176

Assigner: Arista
Reserved: 12.08.2026 Published: 16.09.2026 Updated: 16.09.2026

When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Arista Networks
Product EOS
Versions Default: unaffected
  • affected from 4.35.0F to 4.35.4M (incl.)

Affected Configurations

In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.

switch>show ip interface Ethernet1/1 is up, line protocol is up (connected) Internet address is 192.0.2.1/24 ... IP verify unicast source reachable-via any ...

switch>show ipv6 interface Ethernet1/1 is up, line protocol is up (connected) ... IPv6 verify unicast source reachable-via any ...

switch>show running-config section ip verify interface Ethernet1/1 ip verify unicast source reachable-via any

switch>show running-config section ipv6 verify interface Ethernet1/1 ipv6 verify unicast source reachable-via any

If loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF — neither are affected:

switch>show ip interface Ethernet1/1 is up, line protocol is up (connected) Internet address is 192.0.2.1/24 ... IP verify unicast source reachable-via RX ... Ethernet2/1 is up, line protocol is up (connected) Internet address is 198.51.100.1/24 ...

Workarounds

No mitigation exists for this issue.

Solutions

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.

CVE-2026-73469 has been fixed in the following releases: - 4.36.0F and later releases in the 4.36.x train - 4.35.5M and later releases in the 4.35.x train

No hotfix is available for this issue.

References

Problem Types

  • CWE-863 Incorrect Authorization CWE