CVE-2026-73446

Executive Summary

CVE-2026-73446 is an unauthenticated denial-of-service vulnerability in Arista EOS affecting devices that run the IS-IS routing protocol on broadcast interfaces. A crafted IS-IS Hello Protocol Data Unit (PDU) sent by an adjacent-layer attacker causes the device to tear down an established IS-IS adjacency, resulting in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency. The vulnerability carries a CVSS v3.1 base score of 7.4 (High) and, at the time of writing, no vendor patch, public proof-of-concept, or CISA KEV listing has been identified.

Technical Analysis

The vulnerability is classified under CWE-696 (Incorrect Behavior Order), indicating that the device processes or acts on protocol input in an order or state context that is incorrect, allowing an attacker to influence adjacency state transitions. The attack surface is the IS-IS routing protocol operating on broadcast network segments (e.g., LAN interfaces, including Ethernet broadcast segments where IS-IS uses LAN Hello PDUs to form and maintain adjacencies).

IS-IS operationally relies on Hello PDUs to discover neighbors, negotiate adjacency state, and maintain liveness. On broadcast interfaces, routers elect a Designated Intermediate System (DIS) and maintain adjacency state via periodic Hello exchanges. The NVD description states explicitly that an "unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency." The precise malformed field or state-machine sequencing flaw that triggers the teardown is not detailed in the available description, and no implementation-level specifics (function names, parser routines, or field offsets) are provided. What can be stated with confidence is:

• The flaw resides in the processing of IS-IS Hello PDUs received on broadcast interfaces.
• No authentication or prior privileges are required (PR:N, UI:N).
• The impact is adjacency teardown — a state integrity/availability failure rather than memory corruption (C:N/I:N, A:H).
• The scope is changed (S:C), consistent with the crafted PDU affecting a component (adjacency/routing state) beyond the immediate vulnerable processing context, cascading to prefix reachability.

Because IS-IS is a link-state interior gateway protocol, adjacency teardown forces recomputation of the Shortest Path First (SPF) tree and withdrawal of affected prefixes from the link-state database. Repeated or sustained triggering prevents stable adjacency formation and degrades or eliminates reachability for routes learned through the affected link.

The CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H reflects: adjacent network access required (AV:A — attacker must be on the same broadcast segment or an L2-adjacent position), low attack complexity (AC:L — no specialized conditions beyond protocol reachability), no privileges, no user interaction, changed scope, and a high availability-only impact.

Exploitation Scenarios

No public PoC is available for CVE-2026-73446; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific implementation details, function names, or PDU field values are asserted, as none are provided in the source data.

1. Reconnaissance / target identification. The attacker must obtain Layer-2 adjacency to a network segment on which an Arista EOS device runs IS-IS on a broadcast interface. This is achievable via physical access to a switch port, a compromised host on the same VLAN/broadcast domain, a misconfigured trunk, or a rogue device introduced into the L2 topology. IS-IS PDUs operate directly over Layer 2 (protocol discriminator 0x83, NLPID 0xFE), so no IP-layer reachability is required — an attacker needs the ability to inject crafted Layer-2 frames onto the shared broadcast segment.

2. Triggering the flaw class. The attacker crafts an IS-IS Hello PDU designed to violate the device's expected processing order or adjacency-state logic (CWE-696). Per the description, receipt of this crafted PDU causes the device to tear down an established IS-IS adjacency. The precise malformed element is undisclosed, but the trigger class is a crafted LAN Hello PDU that drives the adjacency state machine into an erroneous teardown transition.

3. Payload / execution method. At the vulnerability-class level, the attacker transmits the crafted IS-IS Hello PDU onto the broadcast segment toward the target device. No authentication, credentials, or user interaction are required. Because IS-IS has no native cryptographic authentication unless explicitly configured (and even then, per the CVSS vector, PR:N/UI:N), an adjacent attacker with L2 injection capability can deliver the PDU.

4. Post-exploitation impact. Successful triggering tears down an established IS-IS adjacency. The device withdraws or fails to use prefixes reachable via that adjacency, causing loss of IP reachability and traffic disruption. Repeated injection can prevent adjacency re-establishment, sustaining the denial of service. The Changed Scope (S:C) reflects impact propagating from the routing control plane to broader network reachability.

Impact Assessment

The CVSS v3.1 base score is 7.4 (High). Subscore analysis:

• Confidentiality (C:N): No confidentiality impact — the flaw does not expose data.
• Integrity (I:N): No direct integrity impact to data; the effect is on routing state, treated as availability.
• Availability (A:H): High availability impact — adjacency teardown causes loss of IP reachability for prefixes advertised through the affected adjacency, disrupting traffic forwarding.
• Attack Vector (AV:A): Adjacent — the attacker needs L2 adjacency to the broadcast segment.
• Privileges/Interaction (PR:N/UI:N): Fully unauthenticated and requires no user action.

Business impact: Affected systems are Arista EOS devices with IS-IS configured on broadcast interfaces, typically in enterprise, service provider, or data center core/aggregation roles. The blast radius extends beyond the single device: adjacency teardown propagates through the IS-IS link-state database, forcing SPF reconvergence and withdrawing reachability for downstream prefixes. In large fabrics, this can cause localized or regional outages, routing instability, and SLA violations. Sustained attack via repeated PDU injection can hold adjacencies down, converting a transient disruption into an extended outage. Because the CVSS vector is availability-only, there is no data-theft or integrity exposure, but operational impact can be severe in networks dependent on IS-IS for reachability.

Detection Guidance

Sigma Rule

title: Arista EOS IS-IS Adjacency Teardown via Crafted Hello PDU (CVE-2026-73446)
id: 8f3c1a52-7344-4e9a-9b21-7a6e0c9d4f10
status: experimental
description: Detects repeated IS-IS adjacency state changes on Arista EOS devices with IS-IS on broadcast interfaces, consistent with crafted Hello PDU injection (CVE-2026-73446).
logsource:
  product: arista
  service: eos
detection:
  selection_event:
    - message|contains: "IS-IS"
    - message|contains:
        - "adjacency"
        - "ADJ"
  selection_state:
    message|contains:
      - "down"
      - "tear"
      - "removed"
      - "Hold timer expired"
  condition: selection_event and selection_state
falsepositives:
  - Legitimate link flaps or maintenance events
  - Interface errors or cabling issues
level: high
tags:
  - attack.t1498
  - cve.2026.73446

YARA Rule

rule CVE_2026_73446_ISIS_Hello_PDU
{
    meta:
        description = "Detects crafted IS-IS Hello PDUs associated with CVE-2026-73446 adjacency teardown on Arista EOS"
        author = "Threat Intelligence - valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73446"
        date = "2026-01-01"
        cve = "CVE-2026-73446"
    strings:
        // IS-IS PDU header: protocol discriminator 0x83 followed by NLPID 0xFE
        $isis_hdr = { 83 FE }
        // IS-IS Hello PDU type identifiers (LAN L1/L2 Hello)
        $hello_l1 = { 0F }
        $hello_l2 = { 10 }
    condition:
        $isis_hdr at 0 and (uint8(4) == 0x0F or uint8(4) == 0x10)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-73446 Suspected Crafted IS-IS Hello PDU (adjacency teardown attempt)"; flow:stateless; content:"|83 FE|"; offset:0; depth:2; byte_test:1,=,0x0F,4; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; reference:cve,2026-73446; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73446; sid:202673446; rev:1;)

alert ip any any -> any any (msg:"CVE-2026-73446 Suspected Crafted IS-IS L2 Hello PDU Flood"; flow:stateless; content:"|83 FE|"; offset:0; depth:2; byte_test:1,=,0x10,4; threshold:type both, track by_src, count 5, seconds 10; classtype:attempted-dos; reference:cve,2026-73446; sid:202673447; rev:1;)

Elastic Detection

sequence by host.name with maxspan=30s
  [ network where network.protocol == "isis" and isis.pdu_type == "hello" ]
  [ network where network.protocol == "isis" and event.action == "adjacency_down" ] |
  where count >= 3

Splunk SPL Query

index=network sourcetype=arista:eos "IS-IS" ("adjacency" OR "ADJ") ("down" OR "tear" OR "removed")
| stats count by host, src, message
| where count >= 3
| sort - count

Wazuh OSSEC Rule

<group name="arista,isis,cve-2026-73446">
  <rule id="100734" level="10">
    <decoded_as>syslog</decoded_as>
    <match>IS-IS</match>
    <regex>adjacency.*(down|tear|removed)</regex>
    <description>CVE-2026-73446: Possible IS-IS adjacency teardown via crafted Hello PDU on Arista EOS</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>dos,cve_2026_73446,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict Layer-2 access to network segments carrying IS-IS traffic; enforce port security, DHCP snooping, dynamic ARP inspection, and 802.1X on access ports to reduce rogue-device and spoofing opportunities.
   • Where operationally feasible, move IS-IS off broadcast interfaces to point-to-point links, which use point-to-point Hello PDUs rather than broadcast LAN Hello PDUs, removing the described attack surface.
   • Enable any available IS-IS authentication mechanisms on the platform to raise the bar for unauthorized PDU injection (note: CVSS reflects PR:N, so authentication alone should not be treated as a complete fix).
   • Monitor IS-IS adjacency state and alert on repeated teardown/reformation cycles (see Detection Guidance).

2. Patch/upgrade steps:

   • No vendor patch is available as of this report (patch confidence 0/4; no vendor fix, workarounds, or affected-version list provided).
   • Monitor the Arista Security Advisory portal and the NVD entry for CVE-2026-73446 for an official EOS patch and affected-version matrix.
   • When a fix is released, follow Arista's standard EOS upgrade procedure, validate IS-IS adjacency stability in a lab, and schedule maintenance-window deployment.

3. Long-term hardening:

   • Segment routing domains and apply control-plane protection (CoPP) to rate-limit IS-IS PDU processing.
   • Enforce strict L2 access control in core/aggregation and data center fabrics.
   • Maintain a vulnerability management program that tracks vendor advisories for routing control-plane software and tests protocol input handling.

References

• NVD — CVE-2026-73446: https://nvd.nist.gov/vuln/detail/CVE-2026-73446
• CWE-696 (Incorrect Behavior Order): https://cwe.mitre.org/data/definitions/696.html
• Arista Security Advisories portal (monitor for CVE-2026-73446 advisory): https://www.arista.com/en/support/advisories-notices
• FIRST EPSS: Not yet scored — check https://www.first.org/epss/ for updates
• CISA Known Exploited Vulnerabilities catalog: Not listed as of this report — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence have been identified for CVE-2026-73446 at the time of writing. No public PoC or Nuclei template is available; the exploitation scenario above is inferred from the vulnerability class and NVD description only.