# CVE-2026-73447: Arista EOS privilege escalation in gNSI Certz

Source: https://junglewise.ai/threats/cve-2026-73447-arista-eos-privilege-escalation-in-gnsi-certz  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-73447 · Severity: critical · CVSS 9.1 · Published 2026-09-16

Arista EOS is a network operating system that runs on Arista switches and routers used to manage network traffic. An authenticated administrator with high privileges can exploit the gRPC Network Security Interface (gNSI) Certz service to execute arbitrary commands with root privileges, fully compromising the device. This affects multiple EOS versions and platforms used in enterprise networks.

Technologies: [Arista Eos](https://junglewise.ai/threats/technologies/eos). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-73447 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-73447 being exploited in the wild.

**How severe is CVE-2026-73447?** Critical severity, with a CVSS score of 9.1, published 16 September 2026.

**Which products and versions are affected?** Arista Eos 4.36.0.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, 4.30.2F and later (4.30.x).

**Is there a fix for CVE-2026-73447?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-73447 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-73447?** Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is OS command injection (CWE-78) in the gNSI Certz service on Arista EOS-based products. An authenticated user with high privileges can craft a malicious Certz Rotate gRPC request that allows arbitrary OS command execution with root privileges. The Bootz service used for initial provisioning is also affected. The attack requires network access to the gNSI service (default port 6030) and an authenticated session with high privileges (PR:H). Arista has released patches for affected EOS versions and provides mitigations including disabling gNSI Certz or implementing strict authorization policies.

## Affected products

- Arista EOS 4.36.0.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, 4.30.2F and later (4.30.x)

## Timeline

- 2026-09-09: disclosed: Initial security advisory released by Arista
- 2026-09-16: advisory: CVE-2026-73447 published to NVD

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162](https://www.arista.com/en/support/advisories-notices/security-advisory/24718-security-advisory-0162)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS RIPv2 silent enablement on management interfaces](https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information)