CVE-2026-73467

mediumpriority · track · 0EPSS 0.001 · 3 %ileDE

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.13% (3rd) EPSS

CVSS 6.3 · medium

Is it mine?

8 products

Check your exposure

Who says so?

1 sources

cert_bund

EPSS · scored 2026-10-28

On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers

cvss

Technical severity, 0–10. One row per scoring source.

6.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.8–6.3

v3.16.3mediumCVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:Hsecondary · psirt@arista.comexploitability 0.3 · impact 5.9

v4.06mediumCVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · psirt@arista.com

v4.01.8lowCVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-532US

affected products (8)

Products and version ranges known to be affected.

Arista EOS <4.33.10Mall versionscert_bundDE
Arista EOS <4.34.8Mall versionscert_bundDE
Arista EOS <4.35.6Mall versionscert_bundDE
Arista EOS <4.36.2Fall versionscert_bundDE
Arista EOS< 4.33.10Mcert_bundDE
Arista EOS< 4.34.8Mcert_bundDE
Arista EOS< 4.35.6Mcert_bundDE
Arista EOS< 4.36.2Fcert_bundDE

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3410Arista EOS: Mehrere SchwachstellenDeutsch2026-09-15csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Arista EOS ausnutzen, um sensible Schlüssel, Passwörter oder TACACS+-Secrets offenzulegen, Sicherheits- und Zugriffskontrollen zu beeinträchtigen, Netzwerk- oder Authentifizierungsdienste zu stören, Benutzerkonten mit erhöhten Berechtigungen auszustatten und im schwerwiegendsten Fall beliebigen Code mit Root-Rechten auf dem betroffenen Switch auszuführen.

sources

Which sources assert this record, and when.

cert_bund NVD CVE.org MITRE

published 2026-09-15modified 2026-09-16

references (1) nvd

External citations — patches, advisories, analysis.

https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan