CVE-2026-73453: Arista EOS P4Runtime RCE Vulnerability

CVE-2026-73453 Overview

CVE-2026-73453 is an unauthenticated remote code execution vulnerability in the P4Runtime (Programming Protocol-Independent Packet Processors Runtime) implementation on Arista EOS. An attacker who can reach the P4Runtime service can send a crafted packet during session initiation and obtain complete administrative control of the affected switch. P4Runtime is disabled by default in Arista EOS, which limits the exposed attack surface to platforms explicitly configured to use it. Arista discovered the issue internally and reports no known exploitation in customer networks. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact

An unauthenticated network attacker can execute arbitrary code and gain full administrative control of Arista EOS switches configured with P4Runtime.

Affected Products

• Arista EOS platforms configured with P4Runtime enabled
• Arista switches exposing the P4Runtime gRPC service to reachable networks
• Deployments where P4Runtime has been manually enabled (not the default configuration)

Discovery Timeline

• 2026-09-16 - CVE-2026-73453 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73453

Vulnerability Analysis

P4Runtime is a control-plane API that allows an external controller to program the packet-forwarding pipeline of a P4-capable data-plane device. On Arista EOS, the P4Runtime service accepts inbound client sessions and processes protocol messages during session initiation. The vulnerability resides in this initiation path, where malformed or crafted input can drive the service into executing attacker-controlled code. Because the service accepts sessions without prior authentication in the affected configuration, an attacker only needs network reachability to the P4Runtime port to trigger the flaw. Successful exploitation yields administrative control of the switch, allowing the attacker to modify forwarding behavior, exfiltrate transiting traffic, pivot into adjacent management networks, or persistently backdoor the device.

Root Cause

The issue is a code injection weakness ([CWE-94]) in the P4Runtime session-establishment logic. The service does not adequately validate or constrain client-supplied data during session setup, permitting attacker input to influence code paths that should not be reachable from an unauthenticated context. Arista's advisory attributes the flaw to the P4Runtime component specifically and does not extend it to other management planes on EOS.

Attack Vector

Exploitation occurs over the network against the P4Runtime gRPC endpoint on an affected switch. The attacker crafts a malicious packet delivered during the initial P4Runtime handshake, before any authentication material would be exchanged in a hardened deployment. Because P4Runtime is disabled by default, only operators that have explicitly enabled the feature are exposed. Any host with routed access to the P4Runtime listener, including compromised management-plane hosts or misconfigured segments, can reach the vulnerable path.

No verified public proof-of-concept code is available. See the Arista Security Advisory #0174 for technical details.

Detection Methods for CVE-2026-73453

Indicators of Compromise

• Unexpected inbound gRPC connections to the P4Runtime port on EOS switches from hosts outside the sanctioned SDN controller inventory.
• Restart events, crashes, or unexplained termination of the P4Runtime agent process in EOS logs.
• New or modified EOS configuration, users, SSH keys, or forwarding entries that do not correlate with authorized change tickets.
• Anomalous outbound connections from a switch's management interface following P4Runtime activity.

Detection Strategies

• Inventory every EOS device and identify those with P4Runtime configured; treat these as high-priority monitoring targets.
• Alert on any P4Runtime session established from a source address that is not on an allow-list of approved controllers.
• Correlate P4Runtime session events with subsequent administrative configuration changes on the same device.
• Ingest EOS syslog and streaming telemetry into a centralized analytics platform to hunt for P4Runtime protocol anomalies.

Monitoring Recommendations

• Enable full command accounting and configuration change logging on all EOS switches and forward logs off-device.
• Monitor management-plane ACL hit counters for denied traffic to the P4Runtime port, which may indicate reconnaissance.
• Baseline normal P4Runtime controller-to-switch traffic patterns and alert on deviations in source, timing, or volume.

How to Mitigate CVE-2026-73453

Immediate Actions Required

• Identify all Arista EOS devices with P4Runtime enabled and disable the service on any device that does not require it.
• Apply the fixed EOS release referenced in Arista Security Advisory #0174 as soon as a maintenance window permits.
• Restrict network reachability to the P4Runtime endpoint using control-plane ACLs so that only known SDN controllers can connect.
• Rotate administrative credentials and inspect device configurations on any switch that may have been exposed.

Patch Information

Arista addresses this vulnerability in updated EOS releases. Consult the Arista Security Advisory #0174 for the definitive list of fixed versions, hotfix availability, and platform-specific guidance. Coordinate upgrades through standard change management to preserve forwarding stability.

Workarounds

• Disable P4Runtime on EOS devices where it is not operationally required; the feature is disabled by default.
• Apply a control-plane ACL that permits P4Runtime traffic only from authorized SDN controller IP addresses and denies all other sources.
• Place P4Runtime controller-to-switch traffic on a dedicated, isolated management VRF that is not routable from user or internet-facing networks.

# Example EOS control-plane ACL restricting P4Runtime access
# Replace <p4rt-port> with the P4Runtime listener port used in your environment
# and <controller-ip> with the authorized SDN controller address.

ip access-list P4RT-CONTROL
   10 permit tcp host <controller-ip> any eq <p4rt-port>
   20 deny  tcp any any eq <p4rt-port> log
   30 permit ip any any

control-plane
   ip access-group P4RT-CONTROL in