Is CVE-2026-73456 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-73456 being exploited in the wild.

How severe is CVE-2026-73456?

Critical severity, with a CVSS score of 10, published 16 September 2026.

Which products and versions are affected?

Arista Eos 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.2F through 4.34.7M (4.34.x).

Is there a fix for CVE-2026-73456?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-73456 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-73456?

Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-73456: Arista EOS gNPSI arbitrary code execution

CVE-2026-73456 · Severity: critical · CVSS 10 · Published 2026-09-16

Arista EOS network switches support an optional gRPC Network Packet Sampling Interface (gNPSI) for remote telemetry collection. Under certain configurations, an unauthenticated attacker can send a specially crafted request to this interface to execute arbitrary code with full administrative privileges on the switch, potentially compromising network infrastructure and enabling data exfiltration or lateral movement.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-73456 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-73456 being exploited in the wild.
How severe is CVE-2026-73456?: Critical severity, with a CVSS score of 10, published 16 September 2026.
Which products and versions are affected?: Arista Eos 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.2F through 4.34.7M (4.34.x).
Is there a fix for CVE-2026-73456?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-73456 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-73456?: Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

CVE-2026-73456 is a code injection vulnerability (CWE-94) in the gNPSI service on Arista EOS-based platforms. The vulnerability occurs when gNPSI is configured with TLS server verification plus metadata authentication, or when mutual TLS is enabled with x509-common-name authentication. An unauthenticated network-based attacker can craft a malicious gNPSI request to achieve arbitrary code execution and gain full administrative control over the affected switch. The vulnerability affects EOS versions 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), and 4.34.2F through 4.34.7M (4.34.x). gNPSI is disabled by default, reducing exposure; mitigation requires configuring mutual TLS with x509-spiffe authentication exclusively.

Affected products

Arista EOS 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.2F through 4.34.7M (4.34.x)

Timeline

2026-09-09: disclosed: Arista Security Advisory 0158 initial release
2026-09-16: advisory: CVE-2026-73456 published

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.