CVE-2026-73454: Arista EOS gNSI Privilege Escalation Flaw

CVE-2026-73454 Overview

CVE-2026-73454 affects Arista Extensible Operating System (EOS) platforms running with gRPC Network Security Interface (gNSI) Credentialz configured. A specially crafted request can trigger unintended modifications to a target account's properties, including the assignment of elevated privileges beyond administrator intent. The flaw is classified under CWE-77: Improper Neutralization of Special Elements used in a Command, indicating a command injection weakness in how Credentialz processes account management requests. Arista published details in Arista Security Advisory #0165. Authenticated attackers with low privileges can exploit the issue over the network to escalate their access on affected switches and routers.

Critical Impact
An authenticated low-privileged attacker can send a crafted gNSI Credentialz request to elevate account privileges on affected Arista EOS devices, undermining role-based access controls on network infrastructure.

Affected Products

Arista EOS platforms with gNSI Credentialz configured
Network devices exposing the gNSI management interface
Refer to Arista Security Advisory #0165 for the authoritative list of affected releases

Discovery Timeline

2026-09-16 - CVE-2026-73454 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73454

Vulnerability Analysis

CVE-2026-73454 resides in the gNSI Credentialz service on Arista EOS. gNSI Credentialz is a gRPC-based interface used to manage account credentials and related properties on network devices. The service fails to properly neutralize special elements passed within account-management requests, allowing an authenticated attacker to influence fields beyond those the request should legitimately modify.

As a result, a specially crafted request can alter properties such as role assignment, group membership, or privilege level on a target account. The attacker does not need administrator privileges to trigger the behavior. Successful exploitation collapses the boundary between low-privileged users and administrative roles on the device.

Because EOS runs on switches and routers that enforce network segmentation and access control, unintended privilege escalation on these devices can extend into broader lateral movement across the managed network.

Root Cause

The root cause is improper neutralization of special elements within command or parameter fields handled by the gNSI Credentialz service ([CWE-77]). Input intended to describe a single account attribute is interpreted in a way that permits modification of unrelated account properties, including privilege-related fields.

Attack Vector

The attack vector is network-based and requires low-level authentication to the gNSI endpoint. An attacker sends a crafted Credentialz gRPC request targeting an existing account. The request manipulates account properties, resulting in elevated privileges or access assigned to the targeted identity. No user interaction is required. Refer to Arista Security Advisory #0165 for protocol-level detail.

Detection Methods for CVE-2026-73454

Indicators of Compromise

Unexpected changes to account roles, privilege levels, or group memberships on Arista EOS devices
gNSI Credentialz requests originating from accounts or hosts that do not normally perform credential management
Newly elevated user accounts appearing in EOS show users or AAA logs without corresponding change tickets
Authentication events showing low-privileged users performing administrative operations shortly after Credentialz activity

Detection Strategies

Enable and forward EOS AAA accounting and gNSI audit logs to a centralized logging platform
Correlate gNSI Credentialz API calls with subsequent account privilege changes to flag unauthorized escalations
Baseline the set of identities authorized to invoke Credentialz operations and alert on deviations
Review configuration diffs on EOS devices for unexpected username, role, or privilege modifications

Monitoring Recommendations

Alert on any gNSI Credentialz mutation performed by non-administrative principals
Monitor administrative sessions initiated from newly elevated accounts within 24 hours of a Credentialz call
Track gRPC connection metadata to the gNSI service, including source IP, client certificate, and account context
Feed EOS syslog and gNSI telemetry into your SIEM or data lake for retrospective hunts against this CVE

How to Mitigate CVE-2026-73454

Immediate Actions Required

Identify all Arista EOS devices with gNSI Credentialz configured and inventory their software versions
Apply the fixed EOS release listed in Arista Security Advisory #0165 as soon as maintenance windows permit
Restrict gNSI access to a dedicated management network and a small set of authorized principals
Audit all existing user accounts on affected devices for unauthorized privilege or role changes

Patch Information

Arista has published remediation guidance and fixed software releases in Arista Security Advisory #0165. Administrators should consult the advisory for the specific EOS versions containing the fix and upgrade affected devices accordingly. The CVE was published on 2026-09-16 and last modified on 2026-09-17 in the NVD.

Workarounds

Disable the gNSI Credentialz service on devices where it is not required for operations
Enforce strict access control lists on the gNSI gRPC endpoint to limit reachability to trusted management hosts
Require mutually authenticated TLS (mTLS) with tightly scoped client certificates for gNSI clients
Reduce the number of accounts authorized to invoke Credentialz operations to the minimum necessary

bash

# Example: restrict management-plane access to gNSI on Arista EOS
# (Consult Arista documentation for exact syntax on your release)
configure
ip access-list MGMT-GNSI
   10 permit tcp <trusted-mgmt-subnet>/24 any eq 6030
   20 deny  tcp any any eq 6030
   30 permit ip any any
!
interface Management1
   ip access-group MGMT-GNSI in
!
end
write memory