CVE-2026-73445 Security Advisory 0167
An incorrect authorization policy may become active during a gRPC stream, potentially bypassing intended security controls on Arista EOS devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73445?
CVE-2026-73445 is a medium-severity authentication bypass vulnerability in Arista Networks EOS, published on 16 Sep 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
Weakness: CWE-20
Which versions are affected by CVE-2026-73445?
How do I fix CVE-2026-73445?
No fix has been published for CVE-2026-73445 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-73445 being exploited?
There is no known exploitation of CVE-2026-73445 in the wild and no public exploit code.
Sources
Also known as GHSA-v35v-w3pj-vq65.