CVE-2026-73440: Arista EOS SNMP Information Disclosure Flaw

CVE-2026-73440 Overview

CVE-2026-73440 affects Arista EOS devices with Simple Network Management Protocol (SNMP) configured. The vulnerability exposes SNMPv3 local or remote user credentials as one-way hashed, localized key values within the device's running and sanitized configurations. An authenticated user who obtains this hashed material can leverage it to perform unauthorized read operations against SNMP tables or send fraudulent trap notifications to the Network Management System (NMS). The issue was discovered internally by Arista, which reports no known malicious exploitation in customer networks. The weakness is categorized as [CWE-212] Improper Removal of Sensitive Information Before Storage or Transfer.

Critical Impact
Authenticated attackers with configuration read access can extract SNMPv3 localized keys and impersonate SNMP users to query MIB tables or spoof trap notifications to the NMS.

Affected Products

Arista EOS platforms with SNMP configured
SNMPv3 local user configurations on affected EOS releases
SNMPv3 remote user configurations on affected EOS releases

Discovery Timeline

2026-09-16 - CVE-2026-73440 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73440

Vulnerability Analysis

SNMPv3 relies on user-specific authentication and privacy keys derived from passphrases using a localization process tied to the engine ID. These localized keys are intended to remain confidential on the device. In affected Arista EOS releases, the running configuration and the sanitized configuration retain these localized key values in hashed form. The show running-config and equivalent sanitized outputs therefore contain material sufficient to authenticate SNMPv3 requests. This is an information exposure flaw ([CWE-212]) rather than a remote code execution or memory corruption issue.

Root Cause

The root cause is improper sanitization of sensitive SNMPv3 key material before it is written to configuration output. Sanitized configurations are intended to be shareable for troubleshooting, but they retain the localized authentication and privacy keys. Because SNMPv3 accepts these localized keys directly for message authentication, the hashed representation is functionally equivalent to a credential rather than a one-way secret.

Attack Vector

Exploitation requires an authenticated user with sufficient privileges to view the running or sanitized configuration. After extracting the localized SNMPv3 keys, the attacker constructs SNMPv3 requests using those keys to query MIB data or issue trap notifications toward the configured NMS. The attack vector is network-based against the SNMP service, but the initial credential exposure occurs on the device management plane. Impact is limited to SNMP read operations and trap spoofing; the flaw does not directly grant configuration write access or code execution.

No verified public exploit code is available. Refer to the Arista Security Advisory #0178 for vendor technical details.

Detection Methods for CVE-2026-73440

Indicators of Compromise

Unexpected SNMP GET or GETBULK requests originating from hosts other than the authorized NMS.
Trap notifications received by the NMS from source addresses inconsistent with the managed device inventory.
Access to show running-config or sanitized configuration exports by accounts that do not typically perform configuration review.

Detection Strategies

Audit AAA logs for users executing configuration display commands and correlate with subsequent SNMPv3 traffic patterns.
Compare SNMPv3 message source addresses against an allowlist of sanctioned NMS collectors and alert on deviations.
Monitor for anomalous SNMP trap volumes or content that does not match known device event baselines.

Monitoring Recommendations

Forward EOS syslog and AAA accounting to a centralized SIEM for correlation of configuration access and SNMP activity.
Enable SNMP request logging on the NMS and alert on authentication failures or unexpected engine ID mismatches.
Track distribution of sanitized configuration files through ticketing and file-sharing systems to identify unauthorized recipients.

How to Mitigate CVE-2026-73440

Immediate Actions Required

Restrict read access to EOS device configurations to a minimal set of trusted administrators using role-based AAA controls.
Apply access control lists so that SNMP requests are accepted only from authorized NMS source addresses.
Rotate all SNMPv3 user passphrases on affected devices after applying the fixed release, which regenerates the localized keys.

Patch Information

Arista has published remediation guidance and fixed release information in Arista Security Advisory #0178. Administrators should consult the advisory for the specific EOS train and version matrix applicable to their deployment and schedule upgrades accordingly.

Workarounds

Limit disclosure of running and sanitized configurations, treating them as credential-bearing artifacts until patched.
Restrict the SNMP agent to authorized NMS subnets using EOS control-plane ACLs and interface-level filters.
Prefer SNMPv3 with privacy (authPriv) and enforce separate credentials per device to limit blast radius if keys are extracted.

bash

# Configuration example: restrict SNMP to authorized NMS and require authPriv
ip access-list standard SNMP-NMS
   permit host 10.10.10.5
   deny any
!
snmp-server community-list SNMP-NMS
snmp-server group secure-grp v3 priv
snmp-server user nmsuser secure-grp v3 auth sha <auth-pass> priv aes <priv-pass>
!
management api http-commands
   no shutdown