CVE-2026-73459: Arista EOS IS-IS Protocol DoS Vulnerability

CVE-2026-73459 Overview

CVE-2026-73459 affects Arista EOS devices with Intermediate System to Intermediate System (IS-IS) routing configured. An unauthenticated attacker on an adjacent network can inject a specially crafted IS-IS Link State PDU (LSP) that causes the legitimate LSP to be prematurely purged from the IS-IS link-state database. The resulting database inconsistency disrupts route calculation and can cause traffic loss across affected network segments. Arista disclosed the issue in Arista Security Advisory #0160. The weakness is classified as [CWE-354] Improper Validation of Integrity Check Value.

Critical Impact
An adjacent unauthenticated attacker can purge legitimate IS-IS LSPs and disrupt routing, leading to traffic loss on affected Arista EOS devices.

Affected Products

Arista EOS platforms with IS-IS routing configured
Devices participating in an IS-IS routing domain on an adjacent Layer 2 segment
Refer to Arista Security Advisory #0160 for the specific EOS release matrix

Discovery Timeline

2026-09-16 - CVE-2026-73459 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73459

Vulnerability Analysis

IS-IS distributes topology information using LSPs stored in a synchronized link-state database on every participating router. Each LSP is identified by a system ID, pseudonode ID, and LSP number, and is protected by a sequence number and checksum.

On affected Arista EOS releases, the IS-IS process does not sufficiently validate crafted LSP PDUs before acting on them. An attacker can inject a PDU that triggers the receiving router to treat a legitimate, in-use LSP as invalid or expired. The router then purges that LSP from its link-state database and floods the purge to IS-IS neighbors.

Once a legitimate LSP is purged, the topology view held by downstream routers becomes inconsistent with reality. Shortest Path First (SPF) recalculation removes reachable prefixes, and traffic that depends on the purged information is dropped until the originating router re-advertises the LSP.

Root Cause

The root cause maps to [CWE-354] Improper Validation of Integrity Check Value. The IS-IS implementation accepts an attacker-crafted LSP PDU whose integrity attributes are not adequately verified against the legitimate LSP already stored in the database, allowing the malicious PDU to override or invalidate it.

Attack Vector

The attack vector is adjacent network. The attacker must be able to send IS-IS traffic on a broadcast or point-to-point link that reaches an IS-IS-enabled interface on the affected router. No authentication is required and no user interaction is involved.

Exploitation involves injecting a malformed or spoofed IS-IS LSP PDU matching the identifiers of a legitimate LSP. The receiving router purges the entry, propagates the purge to neighbors, and forces network-wide SPF recomputation. Repeated injection sustains the traffic loss condition. No verified public exploit code is available; see Arista Security Advisory #0160 for authoritative technical details.

Detection Methods for CVE-2026-73459

Indicators of Compromise

Unexpected IS-IS LSP purge events in EOS logs referencing legitimate system IDs that remain online.
Repeated SPF recomputation on IS-IS routers without corresponding topology changes such as interface flaps.
Sudden loss of specific prefixes from the IS-IS Routing Information Base (RIB) followed by rapid re-advertisement by the originating router.
IS-IS LSP sequence number resets or anomalous zero-lifetime LSPs observed on monitored interfaces.

Detection Strategies

Enable IS-IS event logging on EOS and forward IS-IS and Rib syslog facilities to a centralized platform for correlation.
Baseline normal LSP flooding rates per neighbor and alert on deviations, especially bursts of purges from a single interface.
Capture IS-IS PDUs at aggregation points using SPAN or packet brokers to identify PDUs with anomalous lifetime, checksum, or sequence values.

Monitoring Recommendations

Monitor show isis database detail output for LSPs with Remaining Lifetime of zero that originate from routers known to be operational.
Alert on repeated ISIS-4-LSP_ZERO_LIFETIME or equivalent EOS event codes on production routers.
Track routing convergence metrics and correlate SPF runs with LSP database changes to surface induced churn.

How to Mitigate CVE-2026-73459

Immediate Actions Required

Review Arista Security Advisory #0160 and identify EOS devices running vulnerable releases with IS-IS enabled.
Upgrade affected Arista EOS devices to a fixed release listed in the advisory as soon as change windows permit.
Restrict Layer 2 access to IS-IS-enabled interfaces so that only trusted routers can send IS-IS PDUs.
Verify IS-IS authentication configuration on all adjacencies and areas to reduce the attack surface for spoofed PDUs.

Patch Information

Arista has published fixed EOS versions in Security Advisory #0160. Refer to the advisory for the release matrix mapped to each affected EOS train, along with any hotfix scripts provided as an interim remediation. Apply the vendor-supplied fix rather than relying solely on workarounds.

Workarounds

Configure IS-IS authentication on interfaces, areas, and domains using HMAC-based authentication to reject unauthenticated PDUs.
Enforce port security and 802.1X on access ports that terminate on IS-IS-enabled interfaces to limit adjacent-network exposure.
Segment routing infrastructure so that IS-IS adjacencies traverse only dedicated, physically or logically isolated links.
Apply control-plane policing (CoPP) profiles that rate-limit IS-IS PDUs to reduce the impact of injection attempts.

bash

# Example: enable IS-IS HMAC-SHA authentication on an Arista EOS interface and instance
interface Ethernet1
   isis authentication mode sha key-id 1
   isis authentication key-id 1 algorithm sha-256 key 7 <encrypted-key>
!
router isis CORE
   authentication mode sha
   authentication key-id 1 algorithm sha-256 key 7 <encrypted-key>