CVE-2026-73450: Arista EOS MLAG Denial of Service Vulnerability

CVE-2026-73450 Overview

CVE-2026-73450 affects Arista EOS platforms configured with Multi-Chassis Link Aggregation (MLAG) Dual Primary Detection. An unauthenticated attacker with adjacent network access to the Dual Primary Detection segment can send crafted packets that interfere with dual-primary state signaling. If the MLAG primary switch subsequently fails while these packets persist, the secondary switch misinterprets the situation as a dual-primary condition and err-disables its interfaces. The result is a traffic interruption across the MLAG domain. The weakness is classified under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact
A single crafted packet stream, combined with primary switch failure, can trigger network-wide traffic loss by forcing the secondary MLAG peer to disable its interfaces.

Affected Products

Arista EOS with MLAG Dual Primary Detection configured
Refer to Arista Security Advisory #0161 for the affected EOS release matrix
Deployments where the Dual Primary Detection network segment is reachable by untrusted hosts

Discovery Timeline

2026-09-16 - CVE-2026-73450 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73450

Vulnerability Analysis

MLAG allows two Arista switches to appear as a single logical device to downstream systems. Dual Primary Detection is a safeguard that identifies when both peers believe they are primary, a state that would corrupt forwarding. The feature relies on periodic packets exchanged over a dedicated detection segment.

The vulnerability stems from the switch trusting the contents of Dual Primary Detection packets without adequate authenticity verification. An adjacent attacker can inject crafted packets onto the detection segment. These packets do not immediately cause an outage on their own. The failure condition arises when the actual MLAG primary switch fails while the malicious packets are present, causing the secondary peer to conclude that a dual-primary state exists.

Upon reaching this conclusion, the secondary switch err-disables its interfaces as a protective measure. This produces a full data-plane outage for hosts and links that depend on the MLAG pair.

Root Cause

The root cause is insufficient verification of data authenticity in the Dual Primary Detection protocol implementation. The switch accepts detection packets from the network segment without cryptographic validation of their origin, allowing forged messages to influence peer state decisions.

Attack Vector

Exploitation requires adjacent network access to the Dual Primary Detection segment. No authentication or user interaction is required. The attacker sends specially crafted packets that mimic legitimate detection traffic. The impact manifests only when combined with a failure of the primary MLAG switch. Because no verified proof-of-concept exists in public repositories, refer to the Arista Security Advisory #0161 for protocol-level details.

Detection Methods for CVE-2026-73450

Indicators of Compromise

Unexpected Dual Primary Detection packets originating from MAC or IP addresses not belonging to the MLAG peer
Sudden err-disable events on MLAG secondary switch interfaces coinciding with primary switch failure
Log entries indicating a dual-primary state transition without corresponding operator action

Detection Strategies

Monitor Arista EOS syslog for MLAG state change and err-disable events related to Dual Primary Detection
Baseline the volume and source of packets on the Dual Primary Detection VLAN or interface and alert on deviations
Correlate MLAG peer keepalive loss events with unusual traffic patterns on the detection segment

Monitoring Recommendations

Ingest EOS event logs into a centralized SIEM for continuous inspection of MLAG state transitions
Enable interface counters and port-mirroring on the detection segment to inspect unexpected sources
Alert on any err-disable action that impacts MLAG member ports during a peer failover event

How to Mitigate CVE-2026-73450

Immediate Actions Required

Review the Arista Security Advisory #0161 and identify EOS versions in scope
Restrict the Dual Primary Detection network segment to trusted management infrastructure only
Apply the fixed EOS release provided by Arista once available for your platform

Patch Information

Arista has published remediation guidance in Security Advisory #0161. Consult the advisory for fixed EOS release numbers, hotfix availability, and applicable upgrade paths for each supported platform.

Workarounds

Isolate the Dual Primary Detection link on a dedicated point-to-point connection between MLAG peers, with no third-party access
Use access control lists on any switch handling the detection segment to permit only peer MAC and IP addresses
Disable Dual Primary Detection where operationally acceptable until the patch is applied, accepting the trade-off in failover safety

bash

# Example: restrict the Dual Primary Detection VLAN to peer interfaces only
# Consult Arista documentation for the correct syntax for your EOS version
interface Ethernet49
   description MLAG Dual Primary Detection - peer only
   switchport access vlan <dpd-vlan>
   no lldp transmit
   no lldp receive