CVE-2026-73469 Overview
CVE-2026-73469 affects Arista EOS platforms configured with loose Unicast Reverse Path Forwarding (uRPF). Under specific conditions, traffic that should be dropped by uRPF verification checks is instead processed and forwarded by the device. The flaw undermines a control designed to filter packets with unroutable or spoofed source addresses.
Arista discovered the issue internally and reports no known malicious use in customer networks. The weakness maps to CWE-863: Incorrect Authorization, reflecting the authorization gap in the packet forwarding decision.
Critical Impact
Traffic that a loose uRPF policy should discard may bypass verification and be forwarded, weakening anti-spoofing enforcement at the network edge.
Affected Products
- Arista EOS on specific platforms configured with loose Unicast Reverse Path Forwarding
- Deployments relying on loose uRPF for source-address validation
- Refer to Arista Security Advisory #0176 for the exhaustive platform and version list
Discovery Timeline
- 2026-09-16 - CVE-2026-73469 published to the National Vulnerability Database
- 2026-09-16 - Last updated in the NVD database
Technical Details for CVE-2026-73469
Vulnerability Analysis
Unicast Reverse Path Forwarding is an anti-spoofing mechanism that validates the source address of an incoming packet against the routing table. In loose mode, the router accepts a packet if any route to the source address exists, and drops it otherwise. The check is commonly used to filter packets whose source addresses are unroutable, such as bogons or blackholed prefixes.
On affected Arista EOS platforms, the forwarding pipeline does not consistently apply the loose uRPF verification drop for certain traffic. As a result, packets that should fail the source-address check reach the forwarding stage and traverse the device. The behavior weakens edge filtering, permits spoofed source addresses to transit the network, and can invalidate blackhole routing designs used to drop attack traffic.
Root Cause
The defect is an incorrect authorization decision in the packet forwarding path [CWE-863]. The loose uRPF policy is configured, but the platform fails to enforce the drop action for the affected traffic classes, allowing forwarding despite a routing state that should trigger discard.
Attack Vector
Exploitation requires no authentication and is network-adjacent from the perspective of a device that can send traffic through the affected router. An attacker sending packets with source addresses that should be filtered by loose uRPF, including addresses routed to a discard next-hop, may observe those packets being forwarded. The impact is limited to integrity of the traffic filtering policy; confidentiality and availability are not directly affected. Consult the Arista Security Advisory for the qualifying traffic conditions.
Detection Methods for CVE-2026-73469
Indicators of Compromise
- Ingress traffic with source addresses matching discard or blackhole routes appearing on egress interfaces
- Flow records showing packets from source prefixes that lack a valid forwarding route
- Unexpected uRPF drop counters remaining at zero on interfaces where drops are expected
Detection Strategies
- Compare interface uRPF drop counters against baseline traffic profiles to identify missing enforcement
- Correlate NetFlow or IPFIX telemetry with the routing table to surface spoofed or unroutable source addresses transiting the device
- Deploy test traffic with source addresses routed to Null0 and verify drop behavior on affected platforms
Monitoring Recommendations
- Ingest EOS syslog and SNMP counters into a centralized analytics platform to track uRPF verification drop rates
- Alert on flow-level observations of bogon or reserved source addresses egressing edge routers
- Continuously validate anti-spoofing controls with synthetic packet tests aligned to BCP 38 expectations
How to Mitigate CVE-2026-73469
Immediate Actions Required
- Review Arista Security Advisory #0176 to determine whether your platform and EOS release are affected
- Inventory devices using loose uRPF and identify interfaces relying on the control for anti-spoofing
- Prioritize edge and peering routers that enforce source-address filtering for customer or transit traffic
Patch Information
Arista provides fixed EOS releases in Security Advisory #0176. Apply the version specified for your platform. Where patching cannot be scheduled immediately, use the workarounds described in the advisory to restore the intended filtering behavior.
Workarounds
- Switch from loose uRPF to strict uRPF on interfaces where the topology supports symmetric routing
- Apply explicit ingress access control lists that deny bogon, reserved, and internally routed source prefixes
- Use remotely triggered black hole (RTBH) filtering paired with ACL enforcement rather than relying solely on loose uRPF
- Follow the platform-specific mitigation steps published in the Arista advisory until a patched release is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
