When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.
switch>show ip interface
Ethernet1/1 is up, line protocol is up (connected)
Internet address is 192.0.2.1/24
...
IP verify unicast source reachable-via any
...
switch>show ipv6 interface
Ethernet1/1 is up, line protocol is up (connected)
...
IPv6 verify unicast source reachable-via any
...
switch>show running-config section ip verify
interface Ethernet1/1
ip verify unicast source reachable-via any
switch>show running-config section ipv6 verify
interface Ethernet1/1
ipv6 verify unicast source reachable-via any
If loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF — neither are affected:
switch>show ip interface
Ethernet1/1 is up, line protocol is up (connected)
Internet address is 192.0.2.1/24
...
IP verify unicast source reachable-via RX
...
Ethernet2/1 is up, line protocol is up (connected)
Internet address is 198.51.100.1/24
...
No mitigation exists for this issue.
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2026-73469 has been fixed in the following releases:
- 4.36.0F and later releases in the 4.36.x train
- 4.35.5M and later releases in the 4.35.x train
No hotfix is available for this issue.