CVE-2026-73456: Arista EOS gNPSI RCE Vulnerability

CVE-2026-73456 Overview

CVE-2026-73456 is a critical unauthenticated remote code execution vulnerability affecting Arista EOS platforms with the gRPC Network Packet Sampling Interface (gNPSI) enabled. An attacker can send a crafted gNPSI request to trigger arbitrary code execution on the switch. Successful exploitation grants full administrative control over the compromised device, allowing traffic interception, lateral movement, and persistent network compromise. The flaw is tracked under CWE-94 (Improper Control of Generation of Code). Arista published details in Arista Security Advisory #0158.

Critical Impact

Unauthenticated attackers with network access to the gNPSI service can execute arbitrary code and take full administrative control of affected Arista EOS switches.

Affected Products

• Arista EOS platforms with gNPSI (gRPC Network Packet Sampling Interface) enabled
• Specific affected EOS versions listed in Arista Security Advisory #0158
• Deployments exposing the gNPSI service to untrusted networks

Discovery Timeline

• 2026-09-16 - CVE-2026-73456 published to NVD
• 2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73456

Vulnerability Analysis

The vulnerability resides in the gRPC Network Packet Sampling Interface (gNPSI) service on Arista EOS. gNPSI streams sampled packet data to gRPC clients for network telemetry and monitoring workflows. The service accepts client requests without enforcing authentication under the affected configuration.

A malformed or specially crafted request reaches a code path that improperly processes attacker-controlled input, resulting in arbitrary code execution in the context of the gNPSI service. Because EOS management services typically run with elevated privileges, exploitation yields administrative control over the switch.

An attacker gaining code execution on a core or top-of-rack switch can mirror traffic, alter routing, pivot into management VLANs, and disable logging. The impact extends across confidentiality, integrity, and availability of network segments served by the device.

Root Cause

The issue is classified under CWE-94, Improper Control of Generation of Code. The gNPSI request handler processes untrusted client data in a way that permits attacker-controlled instructions to execute. Arista's advisory identifies the specific request handling flaw and the fixed EOS train.

Attack Vector

Exploitation requires network reachability to the gNPSI service port on the target switch. No authentication or user interaction is required. An attacker on the management network, or any segment able to reach the gNPSI listener, can send a single crafted gRPC request to trigger code execution.

Refer to Arista Security Advisory #0158 for the technical description of the vulnerable request handler. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-73456

Indicators of Compromise

• Unexpected gRPC connections to the gNPSI service port from unknown source addresses
• New administrative user accounts, SSH keys, or configuration changes on EOS devices without change-management records
• Anomalous outbound connections initiated by the switch to attacker-controlled infrastructure
• Unexplained restarts or crashes of the gNPSI agent process in EOS logs

Detection Strategies

• Enumerate all EOS devices with gNPSI enabled and audit which management interfaces expose the service
• Baseline expected gNPSI client IPs and alert on connections from any source outside that baseline
• Monitor EOS event logs for agent crashes, unexpected process restarts, and configuration diffs
• Correlate switch management-plane telemetry with authentication logs to identify configuration changes lacking a corresponding administrator session

Monitoring Recommendations

• Forward EOS syslog, eAPI, and streaming telemetry to a centralized analytics platform for retention and correlation
• Alert on any modification to AAA, logging, or gNPSI configuration blocks
• Track NetFlow or sFlow from management subnets to detect scanning of gRPC ports
• Review firewall and ACL logs for denied and permitted traffic to gNPSI service ports

How to Mitigate CVE-2026-73456

Immediate Actions Required

• Apply the fixed EOS release identified in Arista Security Advisory #0158 as soon as change windows permit
• Disable the gNPSI feature on devices where it is not required for telemetry workflows
• Restrict access to the gNPSI service port with control-plane ACLs limiting sources to authorized collectors
• Isolate switch management interfaces on a dedicated out-of-band network

Patch Information

Arista has published fixed EOS versions in Arista Security Advisory #0158. Administrators should consult the advisory for the exact remediated release trains that correspond to their deployed EOS version and hardware platform.

Workarounds

• Disable gNPSI on affected switches until the fixed EOS release is deployed
• Apply control-plane ACLs to permit gRPC traffic to the gNPSI port only from trusted telemetry collectors
• Place management interfaces behind a jump host with strong authentication and session logging
• Segment switch management VLANs from user, server, and internet-facing networks

# Example control-plane ACL restricting gNPSI access to a trusted collector
! Consult Arista documentation for the correct gNPSI TCP port in your deployment
ip access-list CPP-GNPSI
   10 permit tcp host 10.10.20.5 any eq <gnpsi-port>
   20 deny  tcp any any eq <gnpsi-port> log
   30 permit ip any any
!
control-plane
   ip access-group CPP-GNPSI in
!
! To disable gNPSI entirely where not required:
no management api gnpsi