CVE-2026-73446: Arista EOS IS-IS DoS Vulnerability

CVE-2026-73446 Overview

CVE-2026-73446 affects Arista EOS devices running the Intermediate System to Intermediate System (IS-IS) routing protocol on broadcast interfaces. An unauthenticated attacker on an adjacent network can transmit a crafted IS-IS Hello Protocol Data Unit (PDU) that forces the target device to tear down an established IS-IS adjacency. The resulting adjacency loss disrupts traffic forwarding and removes IP reachability for prefixes advertised through that neighbor. The flaw is classified under CWE-696: Incorrect Behavior Order, reflecting improper handling of protocol state transitions triggered by the malformed PDU.

Critical Impact
A single crafted IS-IS Hello PDU can collapse an established adjacency on a broadcast segment, causing routing convergence events and loss of reachability for advertised prefixes.

Affected Products

Arista EOS platforms with IS-IS configured on a broadcast interface
Refer to Arista Security Advisory #0160 for the enumerated affected release trains
Devices participating in IS-IS Level-1 or Level-2 adjacencies on shared LAN segments

Discovery Timeline

2026-09-16 - CVE-2026-73446 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73446

Vulnerability Analysis

The vulnerability resides in the IS-IS adjacency state machine on broadcast interfaces. IS-IS routers on a LAN exchange Hello PDUs (IIHs) to establish and maintain neighbor relationships and elect a Designated Intermediate System (DIS). When an EOS device processes a specifically crafted IIH from the segment, the protocol implementation transitions the adjacency out of the Up state and tears it down.

Because adjacency loss triggers Link State PDU (LSP) recomputation and Shortest Path First (SPF) recalculation across the routing domain, downstream effects include traffic blackholing, forwarding loops during reconvergence, and loss of reachability for prefixes learned through the affected neighbor. Repeated injection can produce sustained control-plane instability.

The attacker requires no authentication and does not need to establish a legitimate IS-IS session. The attack vector is adjacent (Layer 2), meaning the attacker must have access to the same broadcast segment as the target routing interface.

Root Cause

The root cause maps to CWE-696, where the IS-IS process accepts and acts upon PDU content that should either be rejected or handled without disturbing an existing adjacency. Sequence and validation checks are not enforced correctly, allowing an unauthenticated peer to influence adjacency state.

Attack Vector

Exploitation requires Layer 2 adjacency to an EOS interface participating in IS-IS on a broadcast LAN. The attacker crafts an IIH PDU containing fields that trigger the state-teardown condition and transmits it to the IS-IS multicast destination (01:80:c2:00:00:14 for Level-1, 01:80:c2:00:00:15 for Level-2). No prior session, credentials, or user interaction are required. See the Arista Security Advisory #0160 for validated technical details.

Detection Methods for CVE-2026-73446

Indicators of Compromise

Unexpected IS-IS adjacency state transitions logged as ISIS-4-ADJCHANGE or equivalent EOS syslog entries
Bursts of IIH PDUs on a broadcast interface from unknown System IDs or MAC addresses
Repeated SPF recalculations and LSP flooding events without corresponding topology changes
Traffic loss or forwarding blackholes correlated with adjacency flaps on a single LAN segment

Detection Strategies

Enable IS-IS adjacency change logging and forward events to a centralized SIEM for correlation
Baseline expected IS-IS neighbors per interface and alert when unknown System IDs appear in IIHs
Monitor for ADJCHANGE events that are not paired with legitimate operational activity such as maintenance windows
Capture IS-IS control-plane traffic on suspect segments using span or mirror ports for offline analysis

Monitoring Recommendations

Ingest EOS syslog, sFlow, and SNMP traps into a SIEM or data lake for cross-correlation with routing telemetry
Alert on IS-IS adjacency uptime resets on interfaces facing shared or exposed broadcast domains
Track SPF calculation counters and LSP database churn as leading indicators of protocol abuse
Correlate Layer 2 anomalies, such as unexpected MAC addresses on trunk ports, with control-plane events

How to Mitigate CVE-2026-73446

Immediate Actions Required

Review the Arista Security Advisory #0160 and identify EOS versions running in production
Upgrade affected devices to a fixed EOS release as listed by Arista
Restrict Layer 2 access to segments carrying IS-IS adjacencies, ensuring only trusted routers connect
Enable IS-IS authentication on all adjacencies where supported

Patch Information

Arista has published remediation guidance and fixed release information in Arista Security Advisory #0160. Operators should consult the advisory for the specific EOS release trains, hotfix availability, and any Software Maintenance Upgrade (SMU) provided for their platform.

Workarounds

Configure IS-IS HMAC-MD5 or HMAC-SHA authentication on affected interfaces to validate PDU origin
Convert broadcast IS-IS interfaces to point-to-point where topology permits, reducing exposure to multi-access attacks
Apply Layer 2 access controls such as port security, 802.1X, or MACsec to prevent unauthorized devices from joining the segment
Deploy control-plane policing (CoPP) policies to rate-limit IS-IS PDUs and mitigate flood-based exploitation attempts

bash

# Example IS-IS authentication configuration on Arista EOS
interface Ethernet1
   isis enable CORE
   isis authentication mode md5
   isis authentication key 7 <encrypted-key>

router isis CORE
   authentication mode md5
   authentication key 7 <encrypted-key>