CVE-2026-73462

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.

Score

CVSS 4.0 7.1 High

Status

Awaiting Analysis - psirt@arista.com

Published

2026-09-16

Last modified

2026-09-17

Weaknesses

CWE-125

Affected products

• Eos (Arista Networks)

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24715-security-advisory-0159