Description
An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Published: 2026-09-16
Score: 9.5 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated P4Runtime client can craft a malicious packet during session initiation on Arista EOS, enabling arbitrary code execution and granting full administrative control. This CWE‑94 vulnerability compromises confidentiality, integrity, and availability.

Affected Systems

The flaw affects Arista Networks EOS. Versions impacted include 4.36.x from 4.36.2F onward, 4.35.x from 4.35.6M onward, and 4.34.x from 4.34.8M onward. P4Runtime must be enabled for the vulnerability to be exploitable.

Risk and Exploitability

The CVSS score of 9.5 indicates critical severity, yet the EPSS score is under 1 % and the issue does not appear in the CISA KEV catalog, suggesting a low current exploitation probability. With an open gRPC endpoint, an attacker who can reach the switch could use the vulnerability to execute code remotely. The main attack vector is an unauthenticated P4Runtime session.

Generated by OpenCVE AI on September 18, 2026 at 09:48 UTC.

Remediation

Vendor Solution

The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-73453 has been fixed in the following releases: - 4.36.2F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train No hotfix is available for this issue.

Vendor Workaround

To mitigate this issue, it is recommended to configure the p4-runtime service in mTLS mode (ssl profile with trust certificates). Additionally, enable gNSI Authz to facilitate RPC authorization via the client certificate SPIFFE-ID. Please note that enabling mTLS config will terminate all existing P4 client connections and may cause control plane disruption since packet I/O operations are impacted. Before implementing this solution, the following pre-requisites must be met: 1. Generate SPIFFE-ID client certificate signed by the server trusted CA and use it for establishing P4 client connection to the server. 2. Define a json file with SPIFFE-ID based policies for Authz service and install it on the device using gNSI Authz.Rotate() rpc. switch>show running-config section p4-runtime p4-runtime no shutdown ! transport grpc foo ssl profile campus authentication username priority x509-spiffe switch>show running-config section security management security ssl profile campus certificate server.crt key server.key trust certificate ca.crt switch>show running-config section gnsi management api gnsi service authz

OpenCVE Recommended Actions

  • Upgrade Arista EOS to a remediated software version as soon as possible; the latest patched releases include 4.36.2F or later, 4.35.6M or later, and 4.34.8M or later.
  • If an upgrade cannot be performed immediately, re‑configure the p4-runtime service to run in mTLS mode and enable gNSI Authz to enforce client‑certificate based authorization as described in the advisory.
  • Generate a SPIFFE‑ID client certificate signed by a trusted CA, install the corresponding JSON policy for the gNSI Authz service, and use the certificate to establish the P4Runtime connection.
  • As an additional protective measure, consider disabling the P4Runtime service entirely if it is not required for the switch’s operation.

Generated by OpenCVE AI on September 18, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
First Time appeared Arista
Arista eos
Vendors & Products Arista
Arista eos

Wed, 16 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 10:00:00 +0000

Type Values Removed Values Added
Description An unauthenticated P4Runtime (Programming Protocol-Independent Packet Processors Runtime) client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. P4Runtime is disabled by default in Arista EOS. By crafting a malicious packet during the initiation of a P4Runtime session, an attacker can obtain complete administrative control over the compromised switch. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Title Security Advisory 0174
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.5, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Arista Eos
cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-09-17T03:56:37.219Z

Reserved: 2026-08-12T16:42:47.921Z

Link: CVE-2026-73453

cve-icon Vulnrichment

Updated: 2026-09-16T13:41:57.151Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-16T10:16:52.043

Modified: 2026-09-17T04:17:59.823

Link: CVE-2026-73453

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-18T21:51:41Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')