CVE-2026-73463 Security Advisory 0169
A race condition in Arista EOS gNSI Authz allows revoked users to retain unauthorized gRPC access when multiple transports are configured.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73463?
CVE-2026-73463 is a medium-severity vulnerability in Arista Networks EOS, published on 16 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Weakness: CWE-362
Which versions are affected by CVE-2026-73463?
How do I fix CVE-2026-73463?
No fix has been published for CVE-2026-73463 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73463 being exploited?
There is no known exploitation of CVE-2026-73463 in the wild and no public exploit code.
Sources
Also known as GHSA-v538-9xwx-vp3j.