CVE-2026-73469

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73469", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-08-12T16:47:18.121Z", "datePublished": "2026-09-16T09:55:14.065Z", "dateUpdated": "2026-09-16T13:41:36.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-16T10:13:40.801Z"}, "title": "Security Advisory 0176", "descriptions": [{"lang": "en", "value": "When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.</p><p>This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.</p>"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "defaultStatus": "unaffected", "versions": [{"version": "4.35.0F", "lessThanOrEqual": "4.35.4M", "status": "affected", "versionType": "custom"}], "platforms": ["7050X4 Series", "7358X4 Series"]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.\n\n switch>show ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...\n\n switch>show ipv6 interface\n Ethernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...\n\n switch>show running-config section ip verify\n interface Ethernet1/1\n ip verify unicast source reachable-via any\n\n switch>show running-config section ipv6 verify\n interface Ethernet1/1\n ipv6 verify unicast source reachable-via any\n\nIf loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:\n\n switch>show ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\n Ethernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ...", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.</p><pre>switch>show ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...</pre><pre>switch>show ipv6 interface\nEthernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...</pre><pre>switch>show running-config section ip verify\ninterface Ethernet1/1\n ip verify unicast source reachable-via any</pre><pre>switch>show running-config section ipv6 verify\ninterface Ethernet1/1\n ipv6 verify unicast source reachable-via any</pre><p>If loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:</p><pre>switch>show ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\nEthernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ...</pre>"}]}], "workarounds": [{"lang": "en", "value": "No mitigation exists for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No mitigation exists for this issue.</p>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73469 has been fixed in the following releases:\n- 4.36.0F and later releases in the 4.36.x train\n- 4.35.5M and later releases in the 4.35.x train\n\nNo hotfix is available for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.</p><p>CVE-2026-73469 has been fixed in the following releases:</p><ul><li>4.36.0F and later releases in the 4.36.x train</li><li>4.35.5M and later releases in the 4.35.x train</li></ul><p>No hotfix is available for this issue.</p>"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176", "name": "Security Advisory 0176", "tags": ["vendor-advisory"]}], "source": {"advisory": "Security Advisory 0176", "defects": ["BUG 1353206"], "discovery": "INTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-16T13:41:28.008891Z", "id": "CVE-2026-73469", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T13:41:36.781Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-73469", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T13:41:28.008891Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-16T13:41:32.256Z"}}], "cna": {"title": "Security Advisory 0176", "source": {"defects": ["BUG 1353206"], "advisory": "Security Advisory 0176", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 5.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.35.0F", "versionType": "custom", "lessThanOrEqual": "4.35.4M"}], "platforms": ["7050X4 Series", "7358X4 Series"], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-73469 has been fixed in the following releases:\n- 4.36.0F and later releases in the 4.36.x train\n- 4.35.5M and later releases in the 4.35.x train\n\nNo hotfix is available for this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.</p><p>CVE-2026-73469 has been fixed in the following releases:</p><ul><li>4.36.0F and later releases in the 4.36.x train</li><li>4.35.5M and later releases in the 4.35.x train</li></ul><p>No hotfix is available for this issue.</p>", "base64": false}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176", "name": "Security Advisory 0176", "tags": ["vendor-advisory"]}], "workarounds": [{"lang": "en", "value": "No mitigation exists for this issue.", "supportingMedia": [{"type": "text/html", "value": "<p>No mitigation exists for this issue.</p>", "base64": false}]}], "descriptions": [{"lang": "en", "value": "When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.", "supportingMedia": [{"type": "text/html", "value": "<p>When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.</p><p>This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization"}]}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.\n\n switch>show ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...\n\n switch>show ipv6 interface\n Ethernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...\n\n switch>show running-config section ip verify\n interface Ethernet1/1\n ip verify unicast source reachable-via any\n\n switch>show running-config section ipv6 verify\n interface Ethernet1/1\n ipv6 verify unicast source reachable-via any\n\nIf loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:\n\n switch>show ip interface\n Ethernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\n Ethernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ...", "supportingMedia": [{"type": "text/html", "value": "<p>In order to be vulnerable to CVE-2026-73469, loose mode uRPF must be configured on an interface. This can be checked by showing the interface status, or by checking the current switch config.</p><pre>switch>show ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via any\n ...</pre><pre>switch>show ipv6 interface\nEthernet1/1 is up, line protocol is up (connected)\n ...\n IPv6 verify unicast source reachable-via any\n ...</pre><pre>switch>show running-config section ip verify\ninterface Ethernet1/1\n ip verify unicast source reachable-via any</pre><pre>switch>show running-config section ipv6 verify\ninterface Ethernet1/1\n ipv6 verify unicast source reachable-via any</pre><p>If loose mode uRPF is not configured on an interface, there is no exposure to this issue. In this example, Ethernet1/1 is configured with strict mode uRPF (reachable-via RX), and Ethernet2/1 is not configured with any uRPF \u2014 neither are affected:</p><pre>switch>show ip interface\nEthernet1/1 is up, line protocol is up (connected)\n Internet address is 192.0.2.1/24\n ...\n IP verify unicast source reachable-via RX\n ...\nEthernet2/1 is up, line protocol is up (connected)\n Internet address is 198.51.100.1/24\n ...</pre>", "base64": false}]}], "providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-16T10:13:40.801Z"}}}, "cveMetadata": {"cveId": "CVE-2026-73469", "state": "PUBLISHED", "dateUpdated": "2026-09-16T13:41:36.781Z", "dateReserved": "2026-08-12T16:47:18.121Z", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "datePublished": "2026-09-16T09:55:14.065Z", "assignerShortName": "Arista"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["7050X4 Series", "7358X4 Series"], "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.35.4M", "status": "affected", "version": "4.35.0F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When specific platforms are using Arista EOS with a loose Unicast Reverse Path Forwarding (uRPF) configuration, certain traffic may not be subjected to the intended verification drop. Consequently, traffic that should be dropped based on these routes could still be processed and forwarded by the device.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."}], "id": "CVE-2026-73469", "lastModified": "2026-09-16T19:08:50.420", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73469", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-16T13:41:28.008891Z", "version": "2.0.3"}}]}, "published": "2026-09-16T10:16:52.510", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24732-security-advisory-0176"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-863"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": ["7050x4_series", "7358x4_series"], "status": "affected", "versions": {"scheme": "generic", "value": "[4.35.0F,4.35.4M]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "EOS", "source": "cna", "vendor": "Arista Networks"}, "product": "eos", "vendor": "arista"}], "created": "2026-09-17T20:49:52.282029+00:00", "title": "Arista EOS uRPF Misconfiguration Vulnerability Allowing Unauthorized Traffic Forwarding", "updated": "2026-09-18T10:30:07.499803+00:00", "vendors": ["arista", "arista$PRODUCT$eos"]}