CVE-2026-73463 (GCVE-0-2026-73463)
Vulnerability from cvelistv5
Published
2026-09-16 09:02
Modified
2026-09-16 13:59
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
6.0 (Medium) - CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE
  • CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Summary
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
References
Impacted products
Vendor Product Version
Arista Networks EOS Version: 4.36.0F   <
Version: 4.35.0F   <
Version: 4.34.0F   <
Version: 4.33.0F   <
Version: 4.32.0F   <
Version: 4.31.0F   <
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-73463",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T13:59:22.097938Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T13:59:32.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "710 Series",
            "720D Series",
            "720XP/722XPM Series",
            "750X Series",
            "7010TX Series",
            "7020R/R4 Series",
            "7130 Series running EOS",
            "7170 Series",
            "7050X3/X4 Series",
            "7060X/X2/X4/X5/X6 Series",
            "7260X/X3 Series",
            "7280R/R2/R3/R4 Series",
            "7300X/X3 Series",
            "7320X Series",
            "7358X4 Series",
            "7368X4 Series",
            "7388X5 Series",
            "7500R/R2/R3 Series",
            "7800R3/R4 Series",
            "7700R4 Series",
            "AWE 5000 Series",
            "AWE 7200R Series",
            "CloudEOS",
            "cEOS-lab",
            "vEOS-lab",
            "CloudVision eXchange, virtual or physical appliance"
          ],
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.0.1F",
              "status": "affected",
              "version": "4.36.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.35.5M",
              "status": "affected",
              "version": "4.35.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.34.7M",
              "status": "affected",
              "version": "4.34.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.33.8M",
              "status": "affected",
              "version": "4.33.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.32.11M",
              "status": "affected",
              "version": "4.32.0F",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "4.31.10M",
              "status": "affected",
              "version": "4.31.0F",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnsi\nTransport: default\nTransport enabled: yes\nServer: running on port 6030, in default VRF\n\nTransport: other\nTransport enabled: yes\nServer: running on port 6031, in default VRF\n\nAcctz enabled: no\nAttestz enabled: no\nAuthz enabled: yes\nCertz enabled: no\nCredentialz enabled: no\nEnrollz enabled: no\nPathz enabled: no\u003c/pre\u003e\u003cp\u003ePlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \u0026quot;other\u0026quot; transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport.\u003c/p\u003e"
            }
          ],
          "value": "In order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\n\n  switch#show man api gnsi\n  Transport: default\n  Transport enabled: yes\n  Server: running on port 6030, in default VRF\n\n  Transport: other\n  Transport enabled: yes\n  Server: running on port 6031, in default VRF\n\n  Acctz enabled: no\n  Attestz enabled: no\n  Authz enabled: yes\n  Certz enabled: no\n  Credentialz enabled: no\n  Enrollz enabled: no\n  Pathz enabled: no\n\nPlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \"other\" transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e"
            }
          ],
          "value": "On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T10:13:37.649Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "name": "Security Advisory 0169",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24725-security-advisory-0169"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73463 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e"
            }
          ],
          "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73463 has been fixed in the following releases:\n- 4.36.1F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.7.1M and later releases in the 4.34.x train\n- 4.33.9M and later releases in the 4.33.x train\n\nNo hotfix is available for this issue."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0169",
        "defects": [
          "BUG 1602636"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0169",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRestrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\u003c/p\u003e\u003cp\u003eFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\u003c/p\u003e\u003cpre\u003eswitch(config)#aaa authorization commands all default local\nswitch(config)#aaa authorization config-commands\u003c/pre\u003e\u003cp\u003eNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\u003c/p\u003e\u003cpre\u003eswitch(config-mgmt-api-gnsi)#role network-operator\nswitch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\n256 permit command .*\u003c/pre\u003e"
            }
          ],
          "value": "Restrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\n\nFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\n\n  switch(config)#aaa authorization commands all default local\n  switch(config)#aaa authorization config-commands\n\nNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\n\n  switch(config-mgmt-api-gnsi)#role network-operator\n  switch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\n  256 permit command .*"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-73463",
    "datePublished": "2026-09-16T09:02:19.908Z",
    "dateReserved": "2026-08-12T16:45:03.511Z",
    "dateUpdated": "2026-09-16T13:59:32.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-73463\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T13:59:22.097938Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T13:59:26.563Z\"}}], \"cna\": {\"title\": \"Security Advisory 0169\", \"source\": {\"defects\": [\"BUG 1602636\"], \"advisory\": \"Security Advisory 0169\", \"discovery\": \"INTERNAL\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 5.3, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"EOS\", \"versions\": [{\"status\": \"affected\", \"version\": \"4.36.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.36.0.1F\"}, {\"status\": \"affected\", \"version\": \"4.35.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.35.5M\"}, {\"status\": \"affected\", \"version\": \"4.34.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.34.7M\"}, {\"status\": \"affected\", \"version\": \"4.33.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.33.8M\"}, {\"status\": \"affected\", \"version\": \"4.32.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.32.11M\"}, {\"status\": \"affected\", \"version\": \"4.31.0F\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"4.31.10M\"}], \"platforms\": [\"710 Series\", \"720D Series\", \"720XP/722XPM Series\", \"750X Series\", \"7010TX Series\", \"7020R/R4 Series\", \"7130 Series running EOS\", \"7170 Series\", \"7050X3/X4 Series\", \"7060X/X2/X4/X5/X6 Series\", \"7260X/X3 Series\", \"7280R/R2/R3/R4 Series\", \"7300X/X3 Series\", \"7320X Series\", \"7358X4 Series\", \"7368X4 Series\", \"7388X5 Series\", \"7500R/R2/R3 Series\", \"7800R3/R4 Series\", \"7700R4 Series\", \"AWE 5000 Series\", \"AWE 7200R Series\", \"CloudEOS\", \"cEOS-lab\", \"vEOS-lab\", \"CloudVision eXchange, virtual or physical appliance\"], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\\n\\nCVE-2026-73463 has been fixed in the following releases:\\n- 4.36.1F and later releases in the 4.36.x train\\n- 4.35.6M and later releases in the 4.35.x train\\n- 4.34.7.1M and later releases in the 4.34.x train\\n- 4.33.9M and later releases in the 4.33.x train\\n\\nNo hotfix is available for this issue.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\u003c/p\u003e\u003cp\u003eCVE-2026-73463 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e4.36.1F and later releases in the 4.36.x train\u003c/li\u003e\u003cli\u003e4.35.6M and later releases in the 4.35.x train\u003c/li\u003e\u003cli\u003e4.34.7.1M and later releases in the 4.34.x train\u003c/li\u003e\u003cli\u003e4.33.9M and later releases in the 4.33.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eNo hotfix is available for this issue.\u003c/p\u003e\", \"base64\": false}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24725-security-advisory-0169\", \"name\": \"Security Advisory 0169\", \"tags\": [\"vendor-advisory\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Restrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\\n\\nFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\\n\\n  switch(config)#aaa authorization commands all default local\\n  switch(config)#aaa authorization config-commands\\n\\nNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\\n\\n  switch(config-mgmt-api-gnsi)#role network-operator\\n  switch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\\n  256 permit command .*\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eRestrict the set of users that can enable gNSI on OpenConfig / Octa transports via the CLI.\u003c/p\u003e\u003cp\u003eFirstly, configure AAA authorization. The following is an example of configuring AAA authorization for all privilege levels using only the local user database:\u003c/p\u003e\u003cpre\u003eswitch(config)#aaa authorization commands all default local\\nswitch(config)#aaa authorization config-commands\u003c/pre\u003e\u003cp\u003eNow restrict a sufficient subset of all roles from enabling gNSI services. In the below example, we prohibit just network-operators:\u003c/p\u003e\u003cpre\u003eswitch(config-mgmt-api-gnsi)#role network-operator\\nswitch(config-role-network-operator)#10 deny mode mgmt-api-gnsi command transport gnmi .*\\n256 permit command .*\u003c/pre\u003e\", \"base64\": false}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\\n\\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eOn affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.\u003c/p\u003e\u003cp\u003eThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\\n\\n  switch#show man api gnsi\\n  Transport: default\\n  Transport enabled: yes\\n  Server: running on port 6030, in default VRF\\n\\n  Transport: other\\n  Transport enabled: yes\\n  Server: running on port 6031, in default VRF\\n\\n  Acctz enabled: no\\n  Attestz enabled: no\\n  Authz enabled: yes\\n  Certz enabled: no\\n  Credentialz enabled: no\\n  Enrollz enabled: no\\n  Pathz enabled: no\\n\\nPlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \\\"other\\\" transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cp\u003eIn order to be vulnerable to CVE-2026-73463, gNSI Authz must be enabled with multiple transports configured:\u003c/p\u003e\u003cpre\u003eswitch#show man api gnsi\\nTransport: default\\nTransport enabled: yes\\nServer: running on port 6030, in default VRF\\n\\nTransport: other\\nTransport enabled: yes\\nServer: running on port 6031, in default VRF\\n\\nAcctz enabled: no\\nAttestz enabled: no\\nAuthz enabled: yes\\nCertz enabled: no\\nCredentialz enabled: no\\nEnrollz enabled: no\\nPathz enabled: no\u003c/pre\u003e\u003cp\u003ePlease note that a system may have been affected by this vulnerability if a secondary transport (such as the \u0026quot;other\u0026quot; transport in the preceding example) was configured at any point. The running configuration on the system may have subsequently been modified to remove this secondary transport.\u003c/p\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-09-16T10:13:37.649Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-73463\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-16T13:59:32.239Z\", \"dateReserved\": \"2026-08-12T16:45:03.511Z\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"datePublished\": \"2026-09-16T09:02:19.908Z\", \"assignerShortName\": \"Arista\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.