CVE-2026-73445

Executive Summary

CVE-2026-73445 is a vulnerability in Arista EOS affecting the gRPC Network Security Interface (gNSI) Authz Rotate RPC. A logic/validation flaw in the streaming RPC handling may cause an Authorization (Authz) policy uploaded within an ongoing RPC stream to become active incorrectly — meaning a policy that should not yet be enforced can be applied to the device. The vulnerability requires high privileges (authenticated administrative access) and has no confidentiality or availability impact, but carries a High integrity impact because it can alter the effective security policy state of the switch. Arista discovered the issue internally and states it is not aware of malicious exploitation in customer networks. CVSS 3.1 base score is 4.9 (Medium), and there is no public PoC, exploit code, or Nuclei template. The product is explicitly stated to not affect Bootz.

Technical Analysis

Arista EOS (Extensible Operating System) is the network operating system powering Arista data-center, campus, and routing switches. It exposes management and programmatic interfaces including gRPC-based services. The gRPC Network Security Interface, referred to as gNSI, provides a programmatic surface for managing network security configuration — specifically, in this case, Authz (authorization) policy.

The vulnerability centers on the Authz Rotate RPC. An RPC (Remote Procedure Call) is a request/response interaction exposed over gRPC. The word "Rotate" indicates this RPC is designed to swap, replace, or cycle an authorization policy — a common operational pattern where an administrator stages a new policy and then activates it. The NVD description states that an issue with this RPC "may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active."

Two concepts are relevant here:

1. RPC streaming — gRPC supports client-side, server-side, and bidirectional streaming, where a single logical RPC carries a stream of messages. A "Rotate" operation over a stream implies policy content is uploaded as part of the stream, and activation is meant to occur at a defined point (e.g., when the stream completes or a commit/activate signal is sent). The flaw described is that a policy uploaded mid-stream — i.e., not yet intended to be committed — becomes active.

2. Authz policy state — An authorization policy defines which principals (users, clients, tokens) are permitted to perform which actions against which resources on the device. Because the policy "becomes active" incorrectly, the device's enforcement state diverges from the administrator's intent.

Mapped to CWE-20 (Improper Input Validation), the root cause class is that the Rotate RPC does not correctly validate or sequence the state of the inbound policy stream before applying it. The exact code path, message fields, or state machine are not disclosed in the available description; we do not have function names, protobuf field names, or endpoint paths verbatim, so those cannot be asserted. What can be stated at the vulnerability-class level: a state/sequence validation failure in a streaming configuration-rotation operation causes premature or unintended activation of security policy.

The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N tells us:

• AV:N (Network) — reachable over the network; the gRPC interface is a network service.
• AC:L (Low) — no special conditions beyond what's needed to reach and use the interface.
• PR:H (High) — requires privileged/authenticated access; the attacker must already hold administrative credentials sufficient to invoke the RPC.
• UI:N (None) — no user interaction required.
• S:U (Unchanged) — impact confined to the vulnerable component (the EOS device).
• C:N / I:H / A:N — no confidentiality loss, no availability loss, but High integrity impact: the effective security policy of the device can be changed to an incorrect state.

This profile — high privilege, network-reachable, integrity-only — is characteristic of an insider or compromised-credential misconfiguration-to-exploitation class rather than an unauthenticated remote compromise.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred from the vulnerability class (CWE-20 improper input validation in a streaming RPC) and the CVSS profile (AV:N/AC:L/PR:H). No function names, message field names, or URL paths are fabricated because none appear in the NVD description.

1) Reconnaissance / target identification. An adversary identifies Arista EOS devices with the gRPC management interface enabled and reachable. This is a management-plane service, typically on a management VLAN or restricted address space, but reachable when management interfaces are exposed (e.g., via a jump host, misconfigured ACLs, or over a trusted internal segment). The attacker must possess or obtain administrative credentials or tokens valid for invoking gRPC management operations — consistent with PR:H.

2) Triggering the flaw class. The actor initiates the Authz Rotate RPC (the only operation named verbatim in the description) and supplies an authorization policy via the RPC stream. Because of the improper validation/sequencing flaw, the policy uploaded in the ongoing stream — which under correct operation should not yet be committed/active — is instead applied and becomes the active Authz policy. The attacker does not need to craft a memory-corruption payload; they need to exercise the legitimate streaming RPC in the state that triggers premature activation. In practical terms, the "exploit" is a malformed or mistimed stream sequence that the device fails to validate before applying policy.

3) Execution / effect. The effect is a state change: the device's active authorization policy becomes whatever was uploaded in the stream. Depending on what the uploaded policy contains, this could weaken, replace, or otherwise mis-set the enforcement posture. Because I:H and C:N, the direct technical impact is integrity of configuration/authorization state, not data theft.

4) Post-exploitation impact. The concrete downstream risk of an incorrectly active Authz policy is that the device may enforce authorization that the operator did not intend — potentially allowing actions that policy was meant to deny, or denying legitimate administrative activity. This is a policy-integrity compromise. Combined with the PR:H requirement, the realistic threat model is: (a) an insider with limited administrative rights using the Rotate RPC to push a policy beyond their intended authorization, or (b) an attacker who has already compromised admin credentials using this to entrench a mis-defined policy as a persistence/defense-evasion aid (hence T1562.001). There is no evidence of exploitation in the wild; Arista states it is unaware of malicious use.

Impact Assessment

Business impact: The blast radius is the authorization posture of affected Arista EOS devices running in environments where gNSI Authz is in use. Because an incorrect Authz policy becomes active, an operator's security intent — who can do what on the device — may silently diverge from reality. In a network fabric, an altered authorization policy on a switch could be a stepping stone to broader management-plane abuse, but the CVSS impact is scoped to the device (S:U, I:H, C:N, A:N).

Affected systems: Platforms running Arista EOS with the gNSI / Authz Rotate functionality in use. Bootz is explicitly not affected.

Exploitability: No public PoC, no exploit code, no Nuclei template. EPSS is 0.00326 (25.7th percentile) — low predicted exploitation likelihood in the near term. Not listed in CISA KEV.

CVSS subscores (as given): AV:N, AC:L, PR:H, UI:N, S:U, C:N, I:H, A:N → 4.9 Medium. The single High impact metric (Integrity) combined with the High privilege requirement keeps the base score in the Medium band.

CWE: CWE-20 — Improper Input Validation.

Detection Guidance

The detection rules below target the operational signature of this class: use of the gNSI Authz Rotate RPC, anomalous gRPC management traffic to EOS devices, and unexpected authorization-policy state changes. Because no verbatim endpoint/field strings are disclosed, rules match on the RPC name as documented ("Authz Rotate"), gRPC management transport, and auxiliary administrative-audit signals. Tune field names to your environment's actual EOS syslog/audit schema.

Sigma Rule

title: Arista EOS gNSI Authz Rotate RPC - Suspicious Authorization Policy Rotation
id: 7d1e9a4c-arista-gnsi-authz-rotate
status: experimental
description: Detects invocation of the gRPC Network Security Interface (gNSI) Authz Rotate RPC on Arista EOS, which may cause an incorrect Authz policy to become active (CVE-2026-73445).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73445
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    CommandLine|contains:
      - 'gnsi'
      - 'AuthzRotate'
      - 'Authz Rotate'
  selection_grpc:
    CommandLine|contains:
      - 'grpc'
      - 'grpcurl'
  condition: selection_proc or (selection_proc and selection_grpc)
falsepositives:
  - Legitimate authorized policy rotations by network administrators
  - Automated configuration management pipelines
level: medium
tags:
  - attack.defense_evasion
  - attack.t1562.001
  - cve.2026.73445

Note: this Sigma rule targets host/process visibility where gRPC client tooling is executed. Where deployments instead log the RPC server-side, adapt the logsource to the EOS audit/syslog category and match the Authz Rotate operation name.

YARA Rule

rule CVE_2026_73445_Arista_gNSI_Authz_Rotate
{
    meta:
        description = "Detects artifacts referencing the Arista EOS gNSI Authz Rotate RPC associated with CVE-2026-73445"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73445"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $gnsi  = "gnsi" ascii wide nocase
        $authz = "Authz" ascii wide nocase
        $rotate = "Rotate" ascii wide nocase
        $eos   = "Arista EOS" ascii wide nocase
        $bootz = "Bootz" ascii wide nocase

    condition:
        ($gnsi and $authz and $rotate) and not $bootz
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 443 (msg:"CVE-2026-73445 Arista EOS gNSI Authz Rotate RPC attempt"; flow:established,to_server; content:"|00|"; http2_header_name; content:"te"; nocase; content:"Authz"; nocase; content:"Rotate"; nocase; classtype:attempted-admin; reference:cve,2026-73445; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73445; sid:202673445; rev:1;)

gRPC typically runs over HTTP/2 on TCP 443 (or a management port). Adjust the destination port to match your EOS gRPC configuration. Plaintext gRPC that traverses the sensor is required for content matching; where traffic is TLS-encrypted, rely on server-side audit logging instead.

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where network.transport == "tcp" and destination.port == 443 and
      process.name in ("grpcurl", "grpc_cli") ]
  [ file where file.name : "*.policy" or file.path : "*gnsi*" ]

EQL variant for host-observed gRPC management tooling followed by policy-file activity. Adapt to your telemetry: on platforms exposing EOS gRPC audit logs via Elastic, query event.action : "AuthzRotate" instead.

Splunk SPL Query

index=network OR index=eos sourcetype=arista:eos:syslog
| search ("gnsi" OR "Authz" OR "Rotate" OR "gRPC")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(src_ip) as sources values(dest_ip) as destinations
        by host, user
| where count >= 1
| sort - count

Alternative for gRPC access-log style data:

index=eos (server=*arista* OR vendor=Arista)
| rex field=message "(?<rpc>Authz\s*Rotate)"
| where isnotnull(rpc)
| table _time host user src_ip dest_ip rpc message

Wazuh OSSEC Rule

<group name="arista,eos,gnsi,">
  <rule id="202673445" level="10">
    <decoded_as>json</decoded_as>
    <field name="operation">AuthzRotate</field>
    <description>CVE-2026-73445: Arista EOS gNSI Authz Rotate RPC invoked - potential incorrect Authz policy activation</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <options>alert_by_email</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence, vendor fix, or workaround is available from any tracked source. The steps below are defensive measures based on the vulnerability class and exposed interface, not a confirmed vendor remediation.

1) Immediate mitigations (reduce exposure):

• Restrict the gRPC management plane. Ensure the gRPC / gNSI management interface on Arista EOS is reachable only from trusted management networks, jump hosts, or out-of-band segments. Apply strict management ACLs so that only authorized operators/addresses can invoke management RPCs.
• Rate-limit and audit high-privilege RPCs. Alert on any invocation of the Authz Rotate RPC and correlate with change-management windows. Treat out-of-window RPC policy rotations as suspicious.
• Enforce least privilege. Because exploitation requires PR:H, tightly constrain which accounts can perform policy-rotation operations, and remove broad admin rights where not required.
• Verify active Authz policy state. After any policy rotation, manually confirm the active authorization policy matches intent, since the flaw's effect is a silent divergence from intent.
• Monitor for anomalous Authz state changes using the detection guidance above.

2) Patch / upgrade steps:

• Monitor Arista's official security advisories and EOS release notes for a fix addressing the gNSI Authz Rotate RPC. No fixed version is identified here.
• Engage Arista TAC to obtain the earliest fixed EOS release when published, and schedule an upgrade during a maintenance window.
• Re-validate Authz policies after upgrading to confirm the corrected behavior.

3) Long-term hardening:

• Keep management-plane interfaces off general-purpose network segments; segment and monitor them.
• Centralize EOS audit logging to a SIEM with alerting on management RPC activity.
• Integrate management-plane change detection into configuration drift monitoring for authorization policy state.
• Maintain a software inventory of EOS versions and track vendor advisories for timely patching.

References

• NVD — CVE-2026-73445: https://nvd.nist.gov/vuln/detail/CVE-2026-73445
• Arista Security Advisories (vendor advisory portal): https://www.arista.com/en/support/advisories-notices
• CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
• CVSS 3.1 Specification (FIRST): https://www.first.org/cvss/v3.1/specification-document
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73445 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation status: No known threat actor campaigns, no public PoC, no exploit code, and no Nuclei template. Arista states it discovered the issue internally and is not aware of malicious use in customer networks. EPSS 0.00326 indicates low near-term exploitation likelihood.