Vulnerability · Published Sep 16, 2026 · Assigned by Arista

CVE-2026-73439Security Advisory 0164

High 7.5

In plain English

A high-severity security flaw in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 70.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

On affected platforms running Arista EOS, if OpenConfig is configured and running a gNMI server on the system, and if gNSI Pathz is configured and a gNSI Pathz policy is present on the system, then gNMI may fail to correctly enforce the rules in this policy if both a group rule and a user rule for the same path is present in the policy. Under certain conditions, this can lead to an authenticated user gaining unauthorized permission to read or write gNMI paths that the Pathz policy is intended to restrict.

Affected products (as reported)

Vendor	Product	Versions
Arista Networks	EOS	4.33.2F – through 4.33.8M4.34.0F – through 4.34.6M4.35.0F – through 4.35.5M4.36.0F – through 4.36.0.1F

Weakness: CWE-842 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Arista Networks Security Advisory 0164 vendor-advisory