Vulnerability · Published Sep 16, 2026 · Assigned by Arista

CVE-2026-73447Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

Critical 9.1

In plain English

A critical-severity OS command injection in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).

Severity (CVSS 3.1)9.1Critical

Exploit odds (30 days)0.7%top 46.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

Affected products (as reported)

Vendor	Product	Versions
Arista Networks	EOS	4.30.2F – before 4.31.0F4.31.0F – before 4.32.0F4.32.0F – before 4.33.0F4.33.0F – through 4.33.8M4.34.0F – through 4.34.7M4.35.0F – through 4.35.5M4.36.0F – through 4.36.0.1F

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

Arista Networks Security Advisory 0162 vendor-advisory