CVE-2026-73451: Arista EOS Security ACL DOS Vulnerability

CVE-2026-73451 Overview

CVE-2026-73451 affects Arista EOS running on platforms with dual switch cards where ingress Security Access Control Lists (ACLs) are configured on Switched Virtual Interfaces (SVIs) in shared mode. Restarting the secondary switchcard forwarding agent or inserting a secondary switchcard can cause security ACLs on shared SVIs to stop functioning. This results in incorrect packet permit/deny behavior, potentially allowing traffic that policy should block. Arista discovered the issue internally and reports no known malicious exploitation in customer networks.

Critical Impact
Security ACLs configured on shared SVIs may stop enforcing permit/deny rules after a secondary switchcard event, exposing protected network segments to unfiltered traffic.

Affected Products

Arista EOS on platforms with dual switch cards
Configurations using ingress Security ACLs on Switched Virtual Interfaces (SVIs)
Deployments with SVIs configured in shared mode

Discovery Timeline

2026-09-15 - CVE-2026-73451 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73451

Vulnerability Analysis

The vulnerability resides in how Arista EOS synchronizes Security ACL state across dual switch card forwarding agents. When a secondary switchcard forwarding agent restarts, or when a secondary switchcard is inserted into a chassis, the hardware programming for ingress ACLs bound to shared-mode SVIs is not reliably restored. The result is a silent policy bypass where traffic traversing the affected SVI may no longer be evaluated against the configured ACL rules.

Because SVIs typically enforce segmentation between VLANs and tenant networks, an ACL that fails open removes the boundary between trust zones. Operators receive no explicit warning that enforcement has stopped, so lateral movement or unauthorized east-west traffic can proceed undetected.

Root Cause

The defect is a state synchronization flaw between the primary and secondary switchcard forwarding agents. Shared-mode SVI ACLs depend on both agents holding consistent hardware programming. Agent restart and hot-insertion events do not correctly re-apply the ACL entries to the secondary card's forwarding pipeline.

Attack Vector

Exploitation does not require an attacker to trigger the condition directly. Legitimate operational events such as switchcard hot-insertion, maintenance restarts, or agent crashes place the device in the vulnerable state. Once ACL enforcement lapses, a network-based actor within reach of the affected VLAN can send traffic that policy should deny. See the Arista Security Advisory #0151 for a full technical description.

Detection Methods for CVE-2026-73451

Indicators of Compromise

Unexpected traffic flows between VLANs or tenant segments that a shared-SVI ACL should deny.
Secondary switchcard forwarding agent restart events or switchcard insertion events preceding anomalous traffic.
Netflow, sFlow, or IPFIX records showing successful sessions to protected destinations from sources that were previously blocked.

Detection Strategies

Compare configured ACL policy against observed permit/deny counters on each switchcard after any agent restart or card insertion.
Baseline expected east-west and north-south flow patterns for SVIs and alert on deviations.
Correlate EOS syslog events for Fap or forwarding agent restarts with subsequent flow-record changes.

Monitoring Recommendations

Ingest EOS syslog and eAPI telemetry into a centralized analytics platform and alert on secondary switchcard events.
Track ACL hit counters on shared-mode SVIs and alert when counters flatline after a restart or insertion event.
Continuously validate ACL enforcement using synthetic traffic probes across protected VLAN boundaries.

How to Mitigate CVE-2026-73451

Immediate Actions Required

Review Arista Security Advisory #0151 and identify chassis running dual switch cards with ingress ACLs on shared-mode SVIs.
After any secondary switchcard restart or insertion, verify ACL enforcement by testing known-blocked traffic patterns.
Schedule maintenance windows for switchcard changes and confirm ACL state before returning traffic to the device.

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0151. Apply the fixed EOS release identified in that advisory for the affected platform families.

Workarounds

Reapply the ACL configuration to affected SVIs after any secondary switchcard forwarding agent restart or card insertion to force reprogramming.
Where feasible, convert shared-mode SVI ACLs to per-interface ACLs until the fixed EOS release is deployed.
Restrict trust between VLANs terminating on affected SVIs using upstream firewall enforcement as a compensating control.

bash

# Configuration example: reapply ingress ACL to a shared-mode SVI after a switchcard event
enable
configure
interface Vlan100
  no ip access-group SECURE_IN in
  ip access-group SECURE_IN in
end
show ip access-lists SECURE_IN | include counter