CVE-2026-73464: Arista EOS gNMI RCE Vulnerability

CVE-2026-73464 Overview

CVE-2026-73464 is a code injection vulnerability [CWE-94] affecting Arista Networks EOS devices with the gRPC Network Management Interface (gNMI) enabled. An authenticated client with gNMI access can send a specially crafted request that executes arbitrary code with root privileges on the switch. The flaw impacts the network management plane, giving attackers full administrative control over the underlying operating system rather than only the network configuration layer. Arista published Security Advisory #0166 to document affected releases and remediation guidance.

Critical Impact

A low-privileged authenticated gNMI user can achieve root-level remote code execution on affected Arista EOS switches, compromising the confidentiality, integrity, and availability of the device.

Affected Products

• Arista EOS releases with gNMI enabled (see Arista Security Advisory #0166 for exact versions)
• Arista switching platforms exposing the gRPC Network Management Interface
• Deployments where gNMI is reachable from operator or automation networks

Discovery Timeline

• 2026-09-16 - CVE-2026-73464 published to the National Vulnerability Database
• 2026-09-17 - Last updated in the NVD database

Technical Details for CVE-2026-73464

Vulnerability Analysis

The vulnerability resides in the gNMI service on Arista EOS. gNMI is a gRPC-based protocol used to stream telemetry and manage device configuration. According to Arista Security Advisory #0166, a specially crafted request from an authenticated gNMI client causes arbitrary code to execute on the switch under the root account.

The issue is classified as Improper Control of Generation of Code [CWE-94]. Attacker-supplied input reaches a code generation or evaluation path inside the gNMI request handler without adequate validation. This turns a routine management call into a mechanism for full operating system compromise.

Exploitation crosses a significant privilege boundary. gNMI clients are typically constrained to configuration and telemetry operations, but successful exploitation grants root shell equivalence on the switch OS. From that position an attacker can modify forwarding behavior, install persistence, capture transiting traffic, or pivot into adjacent management systems.

Root Cause

The root cause is unsafe processing of gNMI request content by the EOS gNMI service, allowing attacker-influenced data to be interpreted as executable code rather than treated as opaque management input.

Attack Vector

The attack vector is network-based and requires prior authentication with gNMI access. The attacker sends a crafted gRPC request over the standard gNMI channel. No user interaction is required, and exploitation runs at the privilege level of the gNMI daemon, which is root on the switch.

No public proof-of-concept exploit code is available in the referenced advisory. Readers should consult the Arista Security Advisory #0166 for exact affected releases and technical scope.

Detection Methods for CVE-2026-73464

Indicators of Compromise

• Unexpected gNMI sessions from source addresses outside approved automation ranges or NetOps jump hosts.
• New or modified files, cron entries, or startup scripts on EOS bash shell after gNMI activity.
• Unexplained EOS event-handler, alias, or CLI plugin definitions appearing after management sessions.
• Outbound connections from the switch management interface to unknown hosts following gNMI traffic.

Detection Strategies

• Audit EOS AAA and accounting logs for gNMI sessions and correlate them with configuration or shell activity.
• Baseline expected gNMI callers, request patterns, and payload sizes, and alert on deviations.
• Inspect syslog for gRPC service errors, restarts, or crashes coinciding with management traffic.
• Compare running configuration and file system state against a known-good baseline after suspect sessions.

Monitoring Recommendations

• Forward EOS syslog, accounting, and gNMI telemetry to a central analytics platform for correlation.
• Monitor TCP 6030 and any custom gNMI ports for connections from non-authorized subnets.
• Alert on privileged shell commands executed on switches outside change windows.
• Track credential use for gNMI service accounts and flag reuse from unexpected hosts.

How to Mitigate CVE-2026-73464

Immediate Actions Required

• Apply the fixed EOS release identified in Arista Security Advisory #0166 as soon as a maintenance window permits.
• Restrict gNMI reachability to a dedicated out-of-band management network and trusted automation hosts only.
• Rotate credentials and certificates used by gNMI clients, and revoke any accounts no longer required.
• Review recent gNMI activity and configuration changes for signs of exploitation before patching.

Patch Information

Arista Networks has published remediation details in Arista Security Advisory #0166. The advisory lists the affected EOS trains, fixed versions, and any hotfix availability. Operators should identify their running release with show version and upgrade to a version explicitly listed as fixed.

Workarounds

• Disable the gNMI service on switches where it is not required for operations or telemetry.
• Enforce control-plane ACLs that permit gNMI only from designated management sources.
• Require certificate-based mutual TLS authentication for all gNMI clients and remove password-based access.
• Apply least-privilege AAA roles so that gNMI service accounts cannot be reused for other management planes.

# Example EOS control-plane restriction limiting gNMI to trusted hosts
ip access-list MGMT-GNMI
   10 permit tcp 10.10.0.0/24 any eq 6030
   20 deny  tcp any any eq 6030
   30 permit ip any any
!
management api gnmi
   transport grpc default
      ip access-group MGMT-GNMI
!
# Disable gNMI entirely where not required
management api gnmi
   no transport grpc default