CVE-2026-73446

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

Score

CVSS 3.1 7.4 High

Status

Awaiting Analysis - psirt@arista.com

Published

2026-09-15

Last modified

2026-09-16

Weaknesses

CWE-696

Affected products

• Eos (Arista Networks)

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160