CVE-2026-73468: Network Device DOS Vulnerability

CVE-2026-73468 Overview

CVE-2026-73468 is a network protocol vulnerability that allows an adjacent attacker to send a specially crafted packet that causes premature expiry of multicast forwarding state on affected interfaces. The result is temporary loss of multicast traffic during the affected period. The issue is tracked under [CWE-670: Always-Incorrect Control Flow Implementation] and is documented in Arista Security Advisory #0175. Exploitation does not require authentication or user interaction, but the attacker must be on the adjacent network segment.

Critical Impact
A single crafted packet can disrupt multicast forwarding on affected interfaces, causing temporary loss of multicast traffic to downstream receivers.

Affected Products

Products listed in Arista Security Advisory #0175
Refer to the vendor advisory for the authoritative list of affected software trains and hardware platforms
Specific affected product entries are not included in the NVD record at time of publication

Discovery Timeline

2026-09-16 - CVE CVE-2026-73468 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73468

Vulnerability Analysis

The vulnerability affects the multicast forwarding state machine on affected network interfaces. Multicast forwarding entries normally age out based on protocol timers and control-plane signaling. A specially crafted packet triggers the state to expire earlier than intended. When the state expires, the device stops forwarding the associated multicast group traffic on the affected interface until the state is re-established through normal protocol activity.

The impact is confined to availability of multicast traffic. Confidentiality and integrity of user data are not affected. Applications that depend on continuous multicast delivery, such as market data feeds, IPTV, and industrial control telemetry, can experience service interruption during the affected window.

Root Cause

The root cause is classified under [CWE-670]: the control flow that manages multicast forwarding state lifetimes does not correctly validate the conditions under which state should be removed. A crafted packet drives the state machine into an expiry path that is not appropriate for the current forwarding context.

Attack Vector

The attack vector is Adjacent Network. The attacker must be able to inject packets that reach an affected interface, typically on the same Layer 2 broadcast domain or a directly connected routed segment. No authentication and no user interaction are required. Successful delivery of the crafted packet causes forwarding state to expire immediately on the receiving interface.

No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. Refer to the Arista Security Advisory #0175 for protocol-specific details and packet characteristics.

Detection Methods for CVE-2026-73468

Indicators of Compromise

Unexpected removal or aging-out of multicast forwarding entries on interfaces that should hold steady state
Multicast receivers reporting brief but repeated loss of group traffic without corresponding link or routing events
Increases in IGMP or PIM control-plane activity as receivers re-join groups after state loss

Detection Strategies

Baseline multicast forwarding table stability per interface and alert on premature entry deletions that do not correlate with topology or membership changes
Correlate packet captures on affected VLANs with multicast state changes to identify the triggering frame pattern
Monitor syslog for multicast state-machine events that indicate expiry outside the expected timer window

Monitoring Recommendations

Enable SNMP or streaming telemetry for multicast route and interface counters, and forward events into a central analytics platform for correlation
Alert when the rate of multicast group re-joins on an interface exceeds a normal baseline
Capture packet samples on ports where crafted traffic is suspected, and review for malformed or unusual multicast control messages

How to Mitigate CVE-2026-73468

Immediate Actions Required

Review the Arista Security Advisory #0175 and identify affected platforms and software versions in your environment
Apply vendor-supplied fixed software as soon as it is available and appropriate for your change window
Restrict Layer 2 access to switch ports carrying multicast traffic to trusted devices only

Patch Information

Consult Arista Security Advisory #0175 for fixed software trains, hotfix availability, and platform applicability. The NVD entry does not enumerate fixed versions at time of publication.

Workarounds

Apply control-plane policing or ingress filtering to drop malformed multicast control packets at the network edge
Segment multicast domains so that untrusted hosts cannot reach interfaces participating in multicast forwarding
Use port security and 802.1X to limit which endpoints can inject traffic onto multicast-enabled segments

bash

# Configuration example
# Refer to Arista Security Advisory #0175 for vendor-specific mitigation
# commands. Apply control-plane policing and ingress ACLs on multicast-enabled
# interfaces to limit exposure to crafted packets from untrusted sources.