CVE-2026-73460: Arista EOS IS-IS Graceful Restart DoS Flaw

CVE-2026-73460 Overview

CVE-2026-73460 affects Arista EOS devices running the Intermediate System to Intermediate System (IS-IS) routing protocol with graceful restart enabled. An unauthenticated attacker on the adjacent network can inject a malformed IS-IS Link State PDU (LSP) packet. This malformed packet causes the IS-IS graceful restart procedure to terminate prematurely. The result is traffic loss following a restart event on the affected router. The flaw is categorized as an authorization issue [CWE-863] and impacts availability of network forwarding services.

Critical Impact
A single crafted IS-IS LSP PDU from an adjacent attacker can disrupt graceful restart, producing traffic loss on Arista EOS routers during and after restart events.

Affected Products

Arista EOS platforms with IS-IS graceful restart enabled
See Arista Security Advisory #0160 for the full list of affected EOS releases
Deployments using IS-IS as an interior gateway protocol

Discovery Timeline

2026-09-16 - CVE-2026-73460 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73460

Vulnerability Analysis

The vulnerability resides in the IS-IS graceful restart handler within Arista EOS. Graceful restart allows a router to reload the routing process while neighbors continue forwarding traffic using previously learned routes. This maintains data plane continuity during control plane restarts. When EOS parses an incoming IS-IS LSP PDU during the graceful restart window, a malformed packet triggers an early exit from the restart procedure. Neighbors then withdraw routes before the restarting router rebuilds its adjacencies and link state database. Traffic that depended on the restarting router is dropped until IS-IS reconverges.

Root Cause

The issue is classified under [CWE-863] Incorrect Authorization. The IS-IS process accepts and acts on a malformed LSP PDU without adequate validation of the packet during the graceful restart state machine. Insufficient checks on the PDU structure allow attacker-supplied input to influence the restart procedure's completion logic, terminating it before the router recovers.

Attack Vector

Exploitation requires the attacker to send traffic on the same Layer 2 segment as the target IS-IS interface. IS-IS uses OSI network layer addressing and typically runs on directly connected links, so the attacker must have access to an adjacent broadcast or point-to-point segment. Authentication is not required, and no user interaction is needed. The attacker sends one or more crafted IS-IS LSP PDUs during a restart event to trigger the premature termination. Refer to the Arista Security Advisory #0160 for protocol-level detail.

Detection Methods for CVE-2026-73460

Indicators of Compromise

Unexpected termination of IS-IS graceful restart sequences reported in EOS logs
Traffic loss or route withdrawal correlated with an IS-IS restart event on an affected router
Malformed IS-IS LSP PDUs observed on interfaces where IS-IS is enabled
Repeated IS-IS adjacency flaps following restart operations

Detection Strategies

Enable syslog forwarding for IS-IS process events and inspect for graceful restart failure messages
Monitor routing table churn and prefix withdrawal events during and after control plane restarts
Deploy packet capture on IS-IS-enabled interfaces to identify malformed LSP PDUs
Correlate SNMP or streaming telemetry counters for IS-IS PDU errors with adjacency state changes

Monitoring Recommendations

Alert on IS-IS graceful restart termination events sourced from EOS device logs
Track LSP PDU error counters per interface and baseline expected values
Forward network device logs to a centralized SIEM for cross-device correlation of restart anomalies
Review adjacency logs on peer routers to detect unilateral restart failures

How to Mitigate CVE-2026-73460

Immediate Actions Required

Review Arista Security Advisory #0160 to identify affected EOS versions in your environment
Upgrade affected Arista EOS devices to a fixed release as identified by Arista
Restrict Layer 2 access on IS-IS-enabled segments to trusted devices only
Audit IS-IS interface configuration to confirm graceful restart status and exposure

Patch Information

Arista has documented fixed EOS releases and remediation guidance in Arista Security Advisory #0160. Apply the vendor-supplied fixed release corresponding to the EOS train deployed in production. Coordinate upgrades during maintenance windows to avoid additional restart events.

Workarounds

Disable IS-IS graceful restart on affected devices if operationally acceptable, accepting standard restart behavior
Enable IS-IS authentication (HMAC-MD5 or stronger where supported) to limit which peers can inject PDUs
Apply strict port security and 802.1X on access ports adjacent to IS-IS-enabled interfaces
Segment routing infrastructure links from general-purpose networks to reduce attacker adjacency

bash

# Example: enable IS-IS authentication on an interface (Arista EOS)
interface Ethernet1
   isis authentication mode md5
   isis authentication key 7 <key-string>
!
router isis 1
   authentication mode md5
   authentication key 7 <key-string>