CVE-2026-73465: Arista EOS Information Disclosure Vulnerability

CVE-2026-73465 Overview

CVE-2026-73465 is an information disclosure vulnerability in Arista EOS. Under specific conditions, the operating system writes plaintext private keys to log files during routine operations. The exposure only occurs when non-standard debugging trace levels are explicitly enabled on the device.

Exploitation requires an attacker to already hold authenticated local administrative access to the device shell. Arista discovered the issue internally and reports no known malicious exploitation in customer networks. The weakness is classified under [CWE-532] (Insertion of Sensitive Information into Log File).

Critical Impact
Authenticated administrators with shell access can retrieve plaintext private keys from log files when elevated debug tracing is active, exposing cryptographic material that protects device communications.

Affected Products

Arista EOS (specific affected versions listed in Arista Security Advisory #0153)
Platforms with non-standard debugging trace levels enabled
Devices where administrative shell access is provisioned to multiple operators

Discovery Timeline

2026-09-15 - CVE-2026-73465 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-73465

Vulnerability Analysis

The vulnerability stems from improper handling of sensitive cryptographic material within Arista EOS diagnostic logging. When operators enable specialized non-standard debug trace levels, code paths that process private keys emit the raw key material into log files rather than redacting or masking it.

The exposure is passive. It does not require an active attack against the cryptographic subsystem. Any principal with read access to the affected log files can recover the exposed key material and reuse it outside the device. Recovered keys can be used to impersonate the device, decrypt captured traffic protected by those keys, or forward-authenticate to systems that trust the compromised keypair.

Because the vulnerability requires both administrative shell access and explicit activation of debug tracing, the attack surface is narrow. However, environments that share diagnostic bundles with vendors, ship logs to central collectors, or archive debug output for support cases can broaden the exposure well beyond the original device boundary.

Root Cause

The root cause is missing sanitization in debug trace output paths. Sensitive private key material is passed to logging functions without redaction filters, resulting in plaintext serialization to persistent log storage as documented under [CWE-532].

Attack Vector

An authenticated administrator with local shell access enables the non-standard debug trace level. The device then performs operations that touch private key material, and the raw keys are written to log files. The administrator, or any downstream recipient of those logs, reads the plaintext keys and extracts them for reuse.

No public proof-of-concept exploit code has been released for this issue. Refer to the Arista Security Advisory #0153 for the authoritative technical description and affected release list.

Detection Methods for CVE-2026-73465

Indicators of Compromise

Log files on EOS devices containing PEM headers such as -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----
Configuration history showing activation of non-standard debug trace levels outside of scheduled maintenance windows
Support bundles, tech-support archives, or show tech-support outputs that include key-bearing debug traces
Access to EOS log directories from accounts that do not have a documented operational need

Detection Strategies

Scan centralized log stores and syslog collectors for PEM-encoded key markers originating from Arista devices
Alert on CLI events that enable non-standard trace or debug commands on production switches
Audit tech-support bundles before sharing them externally, blocking transmission when key material is detected
Correlate administrative shell logins with subsequent debug enablement and log file access

Monitoring Recommendations

Ingest EOS syslog and audit streams into a SIEM and flag debug-level configuration changes
Track file reads against /var/log and archive directories on EOS devices
Monitor egress of support bundles and diagnostic archives from the management network

How to Mitigate CVE-2026-73465

Immediate Actions Required

Disable any non-standard debugging trace levels currently active on Arista EOS devices
Rotate all private keys that may have been written to log files during periods when debug tracing was enabled
Purge or securely delete historical log files, tech-support bundles, and archives that could contain exposed key material
Restrict administrative shell access to the minimum set of operators and enforce multi-factor authentication

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0153. Consult the advisory for the fixed EOS train applicable to each affected platform and upgrade following Arista's documented procedure.

Workarounds

Leave non-standard debug trace levels disabled during normal operations and enable them only for time-boxed troubleshooting under change control
Sanitize show tech-support and log bundles before sharing them with third parties or vendors
Apply strict file system permissions on EOS log directories and forward logs to a segmented collector with restricted access

bash

# Verify no non-standard debug trace levels are enabled
show running-config | include trace
show logging | include -i "BEGIN.*PRIVATE KEY"

# Disable debug tracing (example pattern; consult Arista advisory for exact agents)
configure
no trace <agent-name> setting
end
write memory