{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73444",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:04:26.052032Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:04:45.344Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange",
            "virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "changes": [
                {
                  "at": "4.36.2F",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.35.6M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.34.8M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0",
              "versionType": "custom"
            },
            {
              "changes": [
                {
                  "at": "4.33.10M",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "4.33.9M",
              "status": "affected",
              "version": "4.33.0",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show running-config section vrrp\ninterface Ethernet1\n   vrrp 1 ipv4 version 2\n   vrrp 1 peer authentication ietf-md5 key-string 7 \u0026lt;key\u0026gt;\u003c/pre\u003e\u003cp\u003eIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.\u003c/p\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\n\n\n\nswitch\u003eshow running-config section vrrp\ninterface Ethernet1\n   vrrp 1 ipv4 version 2\n   vrrp 1 peer authentication ietf-md5 key-string 7 \u003ckey\u003e\n\n\n\nIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This issue was discovered internally by Arista."
        }
      ],
      "datePublic": "2026-09-09T21:09:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "ADJACENT",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-303",
              "description": "CWE-303 Incorrect Implementation of Authentication Algorithm",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T21:11:37.625Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\n\n  *  4.36.2F and later releases in the 4.36.x train\n  *  4.35.6M and later releases in the 4.35.x train\n  *  4.34.8M and later releases in the 4.34.x train\n  *  4.33.10M and later releases in the 4.33.x train"
        }
      ],
      "source": {
        "advisory": "157",
        "defect": [
          "1866656"
        ],
        "discovery": "INTERNAL"
      },
      "title": "On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRestricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\u003c/p\u003e\u003cpre\u003eswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3\u003c/pre\u003e"
            }
          ],
          "value": "Restricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\n\n\n\nswitch(config)# interface vlan 20\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73444",
    "datePublished": "2026-09-15T21:11:37.625Z",
    "dateReserved": "2026-08-12T16:39:35.977Z",
    "dateUpdated": "2026-09-16T18:04:45.344Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73444\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T18:04:26.052032Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T18:04:41.501Z\"}}], \"cna\": {\"title\": \"On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the\", \"source\": {\"defect\": [\"1866656\"], \"advisory\": \"157\", \"discovery\": \"INTERNAL\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This issue was discovered internally by Arista.\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 5.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"ADJACENT\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"changes\": [{\"at\": \"4.36.2F\", \"status\": \"unaffected\"}], \"version\": \"4.36.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.1F\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.35.6M\", \"status\": \"unaffected\"}], \"version\": \"4.35.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.35.5M\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.34.8M\", \"status\": \"unaffected\"}], \"version\": \"4.34.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.34.7M\"}, {\"status\": \"affected\", \"changes\": [{\"at\": \"4.33.10M\", \"status\": \"unaffected\"}], \"version\": \"4.33.0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.33.9M\"}, {\"status\": \"affected\", \"version\": \"0\"}], \"platforms\": [\"710 Series\", \"720D Series\", \"720XP/722XPM Series\", \"750X Series\", \"7010TX Series\", \"7020R/R4 Series\", \"7130 Series running EOS\", \"7170 Series\", \"7050X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7260X/X3 Series\", \"7280R/R2/R3/R4 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500R/R2/R3 Series\", \"7800R3/R4 Series\", \"7700R4 Series\", \"AWE 5000 Series\", \"AWE 7200R Series\", \"CloudEOS\", \"cEOS-lab\", \"vEOS-lab\", \"CloudVision eXchange\", \"virtual or physical appliance\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\\n\\n  *  4.36.2F and later releases in the 4.36.x train\\n  *  4.35.6M and later releases in the 4.35.x train\\n  *  4.34.8M and later releases in the 4.34.x train\\n  *  4.33.10M and later releases in the 4.33.x train\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73444 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.2F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.8M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.10M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-09-09T21:09:00.000Z\", \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24713-security-advisory-0157\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Restricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\\n\\n\\n\\nswitch(config)# interface vlan 20\\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRestricting physical and logical access to VRRP-enabled segments reduces the attack surface. Additionally, migrating virtual routers from VRRP version 2 with authentication to VRRP version 3 removes the vulnerable code path:\u003c/p\u003e\u003cpre\u003eswitch(config)# interface vlan 20\\nswitch(config-if-vl20)# vrrp 1 ipv4 version 3\u003c/pre\u003e\", \"base64\": false}]}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.5\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-303\", \"description\": \"CWE-303 Incorrect Implementation of Authentication Algorithm\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\\n\\n\\n\\nswitch\u003eshow running-config section vrrp\\ninterface Ethernet1\\n   vrrp 1 ipv4 version 2\\n   vrrp 1 peer authentication ietf-md5 key-string 7 \u003ckey\u003e\\n\\n\\n\\nIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn order to be vulnerable to CVE-2026-73444, VRRPv2 must be configured with IP-AH authentication on at least one interface:\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show running-config section vrrp\\ninterface Ethernet1\\n   vrrp 1 ipv4 version 2\\n   vrrp 1 peer authentication ietf-md5 key-string 7 \u0026lt;key\u0026gt;\u003c/pre\u003e\u003cp\u003eIf VRRP is not configured, or is configured as version 3, or is configured without authentication, there is no exposure.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-15T21:11:37.625Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73444\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T18:04:45.344Z\", \"dateReserved\": \"2026-08-12T16:39:35.977Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-15T21:11:37.625Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}