{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-73459", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-08-12T16:45:03.511Z", "datePublished": "2026-09-15T23:16:27.270Z", "dateUpdated": "2026-09-15T23:16:27.270Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-15T23:16:27.270Z"}, "title": "Security Advisory 0160", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-354", "description": "CWE-354: Improper Validation of Integrity Check Value", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-272", "descriptions": [{"lang": "en", "value": "CAPEC-272 Protocol Manipulation"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.36.0", "lessThanOrEqual": "4.36.1F", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.</p>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160", "name": "Security Advisory 0160", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.4, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to CVE-2026-73459, the following condition must be met: \n\nIS-IS should be configured.\n\n\n\nswitch# show isis summary\nIS-IS Instance: 1 VRF: default\n\u00a0\u00a0Instance ID: 0\n\u00a0\u00a0System ID: 1111.1111.1001, administratively enabled\n\u00a0\u00a0Router ID: IPv4: 0.0.0.0\n\u00a0\u00a0Multi Topology disabled, not attached\n\u00a0\u00a0IPv4 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IPv6 Preference: Level 1: 115, Level 2: 115\n\u00a0\u00a0IS-Type: Level 1 and 2, Number active interfaces: 1\n\u00a0\u00a0Routes both IPv4 and IPv6\n\u00a0\u00a0LSP size maximum: Level 1: 1492, Level 2: 1492\n\u00a0\u00a0Interval Type \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 Max Wait Initial Wait Hold Interval\n\u00a0\u00a0----------------------- -------- ------------ -------------\n\u00a0\u00a0LSP generation interval\u00a0 \u00a0 \u00a0 5 s\u00a0 \u00a0 \u00a0 \u00a0 50 ms \u00a0 \u00a0 \u00a0 \u00a0 50 ms\n\u00a0\u00a0SPF interval\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 30000 ms \u00a0 \u00a0 \u00a0 300 ms \u00a0 \u00a0 \u00a0 \u00a0 80 ms\n\u00a0\u00a0Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n\u00a0\u00a0Last Level 1 SPF run 9 seconds ago\n\u00a0\u00a0Last Level 2 SPF run 9 seconds ago\n\u00a0\u00a0CSNP generation interval: 10 seconds\n\u00a0\u00a0Dynamic Flooding: Disabled\n\u00a0\u00a0Authentication mode: Level 1: None, Level 2: None\n\u00a0\u00a0Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n\u00a0\u00a0Area addresses: 40\n\u00a0\u00a0level 1: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0level 2: number DIS interfaces: 0, LSDB size: 1\n\u00a0\u00a0\u00a0\u00a0Area Leader: None\n\u00a0\u00a0\u00a0\u00a0Overload Bit is not set.\u00a0\n\u00a0\u00a0Redistributed Level 1 routes: 0 limit: Not Configured\n\u00a0\u00a0Redistributed Level 2 routes: 0 limit: Not Configured\n\n\n\nIf IS-IS is not configured, there is no exposure to this issue.\n\n\n\n\nswitch#show isis summary\nswitch#", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In order to be vulnerable to CVE-2026-73459, the following condition must be met: <br><br>IS-IS should be configured.</p><pre>switch# show isis summary\nIS-IS Instance: 1 VRF: default\n&nbsp;&nbsp;Instance ID: 0\n&nbsp;&nbsp;System ID: 1111.1111.1001, administratively enabled\n&nbsp;&nbsp;Router ID: IPv4: 0.0.0.0\n&nbsp;&nbsp;Multi Topology disabled, not attached\n&nbsp;&nbsp;IPv4 Preference: Level 1: 115, Level 2: 115\n&nbsp;&nbsp;IPv6 Preference: Level 1: 115, Level 2: 115\n&nbsp;&nbsp;IS-Type: Level 1 and 2, Number active interfaces: 1\n&nbsp;&nbsp;Routes both IPv4 and IPv6\n&nbsp;&nbsp;LSP size maximum: Level 1: 1492, Level 2: 1492\n&nbsp;&nbsp;Interval Type &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Max Wait Initial Wait Hold Interval\n&nbsp;&nbsp;----------------------- -------- ------------ -------------\n&nbsp;&nbsp;LSP generation interval&nbsp; &nbsp; &nbsp; 5 s&nbsp; &nbsp; &nbsp; &nbsp; 50 ms &nbsp; &nbsp; &nbsp; &nbsp; 50 ms\n&nbsp;&nbsp;SPF interval&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 30000 ms &nbsp; &nbsp; &nbsp; 300 ms &nbsp; &nbsp; &nbsp; &nbsp; 80 ms\n&nbsp;&nbsp;Current SPF hold interval(ms): Level 1: 80, Level 2: 80\n&nbsp;&nbsp;Last Level 1 SPF run 9 seconds ago\n&nbsp;&nbsp;Last Level 2 SPF run 9 seconds ago\n&nbsp;&nbsp;CSNP generation interval: 10 seconds\n&nbsp;&nbsp;Dynamic Flooding: Disabled\n&nbsp;&nbsp;Authentication mode: Level 1: None, Level 2: None\n&nbsp;&nbsp;Graceful Restart: Disabled, Graceful Restart Helper: Enabled\n&nbsp;&nbsp;Area addresses: 40\n&nbsp;&nbsp;level 1: number DIS interfaces: 0, LSDB size: 1\n&nbsp;&nbsp;&nbsp;&nbsp;Area Leader: None\n&nbsp;&nbsp;&nbsp;&nbsp;Overload Bit is not set.&nbsp;\n&nbsp;&nbsp;level 2: number DIS interfaces: 0, LSDB size: 1\n&nbsp;&nbsp;&nbsp;&nbsp;Area Leader: None\n&nbsp;&nbsp;&nbsp;&nbsp;Overload Bit is not set.&nbsp;\n&nbsp;&nbsp;Redistributed Level 1 routes: 0 limit: Not Configured\n&nbsp;&nbsp;Redistributed Level 2 routes: 0 limit: Not Configured</pre><p>If IS-IS is not configured, there is no exposure to this issue.<br></p><pre>switch#show isis summary\nswitch#&nbsp;</pre>"}]}], "workarounds": [{"lang": "en", "value": "No workaround is available for this issue.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>No workaround is available for this issue.</p>"}]}], "solutions": [{"lang": "en", "value": "The recommended resolution is to upgrade to a fixed software version.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>The recommended resolution is to upgrade to a fixed software version.</p>"}]}], "credits": [{"lang": "en", "value": "This issue was discovered internally by Arista and the company is not aware of any malicious uses of these issues in customer networks.", "type": "finder"}], "source": {"advisory": "0160", "discovery": "UNKNOWN", "defects": ["BUG1840507"]}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.36.1F", "status": "affected", "version": "4.36.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss."}], "id": "CVE-2026-73459", "lastModified": "2026-09-16T00:17:05.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}]}, "published": "2026-09-16T00:17:05.213", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-354"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{}