CVE-2026-73450

Executive Summary

CVE-2026-73450 is a network-adjacent denial-of-service vulnerability in Arista EOS affecting platforms configured with Multi-Chassis Link Aggregation (MLAG) Dual Primary Detection. An unauthenticated attacker with access to the Dual Primary Detection network segment can transmit crafted packets that cause the secondary MLAG peer to incorrectly enter a dual-primary error state if the primary switch fails while those packets are present. This results in err-disabled interfaces and a traffic interruption (availability impact) for the affected MLAG domain. No public exploit code, Nuclei template, or CISA KEV listing currently exists, and no vendor patch has been confirmed through tracked sources.

Technical Analysis

Arista EOS implements MLAG to present a two-switch pair to downstream devices as a single logical LAG endpoint, providing link and device redundancy. A core component of this architecture is Dual Primary Detection, a mechanism designed to detect split-brain or "dual-primary" conditions where both MLAG peers independently believe they are the active primary. In normal operation, Dual Primary Detection transmits and receives control messages across a dedicated detection path (often a management or dedicated peer link/segment). If a peer detects that both switches are asserting primacy, the switch that is not expected to be primary err-disables its MLAG member interfaces to prevent forwarding loops and duplicate traffic.

The vulnerability (classified under CWE-345, Insufficient Verification of Data Authenticity) stems from insufficient validation of the packets processed by the Dual Primary Detection mechanism. An attacker positioned on the Dual Primary Detection network segment can inject specially crafted packets that interfere with the dual-primary state logic. Critically, the flaw is a race/state-corruption condition: the malformed or spoofed detection packets do not cause immediate err-disable. Instead, they corrupt the state assessment of the secondary switch, so that when the primary switch subsequently fails, the secondary — rather than assuming the primary role as intended — incorrectly concludes it is in a dual-primary condition and err-disables its interfaces.

Key technical characteristics derivable from the description:

• Attack surface: The Dual Primary Detection network segment (adjacent network, not internet-facing).
• Preconditions: MLAG Dual Primary Detection must be configured on affected platforms; the attacker must have L2/L3 access to that detection segment; the primary switch must fail while the crafted packets are present (a conditional trigger).
• Mechanism class: Insufficient authenticity verification of control-plane packets enabling state manipulation, leading to a fail-safe mechanism (interface err-disable) firing erroneously.
• Impact type: Availability (traffic interruption) with a subordinate integrity effect on the detection state (CVSS I:L).
• Scope change: The CVSS vector includes S:C, reflecting that the compromise of the detection state propagates to affect the broader MLAG forwarding domain beyond the vulnerable component.

Because the NVD description does not disclose the specific packet format, protocol fields, port numbers, or the exact forged message type, no code-level or packet-level detail can be asserted beyond the above. Implementers must treat the Dual Primary Detection traffic as an unauthenticated control channel whose authenticity is not adequately verified.

Exploitation Scenarios

No public Proof-of-Concept exists. The following chain is inferred strictly from the vulnerability class (CWE-345) and the NVD description; it deliberately avoids fabricating protocol field names or packet structures that are not disclosed.

1. Reconnaissance / Target Identification. The attacker must first gain access to the network segment carrying MLAG Dual Primary Detection traffic. This is a prerequisite per the advisory — the attacker is "with access to the Dual Primary Detection network segment." An adversary with a foothold on that segment (e.g., a compromised host, a misconfigured access port, or a positioned attack node) can identify MLAG peers by observing the periodic Dual Primary Detection exchanges between the two switches.

2. Triggering the flaw class (Insufficient Authenticity Verification). The attacker crafts packets that are accepted by the Dual Primary Detection mechanism without adequate authenticity verification (CWE-345). The specific content is not publicly disclosed, but the class of attack is control-plane message spoofing/injection onto the detection channel. The attacker impersonates or manipulates the peer's detection state so that the secondary switch's view of the MLAG topology becomes corrupted.

3. Payload / Execution method (class level). The injected packets do not need to be authenticated by the receiving switch — that absence of verification is the root cause. Repeated or strategically timed injection manipulates the secondary's recorded dual-primary state. No payload code execution is involved; the "payload" is a state-manipulation packet at the network control layer.

4. Conditional firing and post-exploitation impact. The corrupted state remains latent. When the legitimate MLAG primary switch fails (a normal failover event, which could itself be induced by the attacker or occur naturally), the secondary switch — instead of taking over — incorrectly concludes a dual-primary condition exists and err-disables its MLAG interfaces. The result is a full MLAG-domain traffic interruption: the failover that was supposed to preserve availability instead takes the secondary's links down. Post-exploitation impact is denial of service against the affected LAG/MLAG domain (CVSS A:H), with the network segment's availability degraded until interfaces are manually recovered.

No exploitation-in-the-wild evidence, threat actor attribution, or exploit sale listing is associated with this CVE at time of writing.

Impact Assessment

• Availability (High, A:H): The primary impact is a traffic interruption across the MLAG domain because the standby switch err-disables its interfaces instead of assuming the primary role. This defeats the redundancy the MLAG pair was deployed to provide — a resilience-inverting failure mode.
• Integrity (Low, I:L): The dual-primary detection state itself is manipulated, giving a limited integrity impact on the control-plane state.
• Confidentiality (None, C:N): No disclosure of data is described.
• Attack Vector (Adjacent, AV:A): Exploitation requires adjacency to the Dual Primary Detection segment — not remotely exploitable over the internet.
• Attack Complexity (High, AC:H): Exploitation requires a precise combination of crafted packets and the concurrent or subsequent failure of the primary switch, i.e., a race/conditional timing requirement, justifying the High complexity rating.
• Privileges (None, PR:N) / User Interaction (None, UI:N): The attacker needs no credentials and no victim interaction.
• Scope (Changed, S:C): Compromise of the detection component impacts resources beyond itself — the downstream forwarding domain loses connectivity.
• Blast radius: Any service, host, or downstream device whose connectivity depends on the affected MLAG pair. Environments that treat MLAG as their availability backbone (data centers, campus cores, service-provider aggregation) face the greatest business impact: loss of redundancy precisely when it is needed (during a primary failure), potentially escalating a single-switch failure into a full LAG outage. CVSS score: 6.9 (Medium).

Detection Guidance

Note: Because specific packet formats, ports, and protocol fields are not disclosed in the source data, the following rules are behavioral/architecture-level detection templates. They detect anomalous control-plane activity on the Dual Primary Detection segment, unexpected interface err-disable transitions, and MLAG state anomalies — not a known malicious byte pattern. Tune thresholds to the environment.

Sigma Rule

title: Arista EOS MLAG Dual Primary Detection State Anomaly
id: 7f3a1c2e-4b8d-4a91-9c2f-mlag0001cve73450
status: experimental
description: Detects anomalous MLAG dual-primary detection activity consistent with CVE-2026-73450 manipulation of dual-primary state.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73450
author: valtersit.com
date: 2026/01/01
logsource:
  product: arista
  service: eos
detection:
  selection_errdisable:
    event_action: 'interface'
    interface_state: 'err-disabled'
  selection_mlag:
    mlag_role: 'secondary'
    dual_primary_state|contains:
      - 'dual-primary'
      - 'err-disable'
  condition: selection_mlag and selection_errdisable
falsepositives:
  - Legitimate primary switch hardware failure causing genuine dual-primary detection
  - Maintenance-induced MLAG reconvergence
level: medium
tags:
  - attack.t1499
  - cve.2026.73450

YARA Rule

rule CVE_2026_73450_Arista_MLAG_Config_Artifact
{
    meta:
        description = "Detects Arista EOS configuration/artifact references to MLAG Dual Primary Detection relevant to CVE-2026-73450"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73450"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $mlag1 = "dual-primary detection" nocase
        $mlag2 = "mlag" nocase
        $mlag3 = "dual-primary" nocase
        $eos1  = "Arista EOS" nocase
        $err1  = "err-disable" nocase

    condition:
        (uint16(0) == 0x0A0D or uint32(0) == 0x0A0D0A0D or true) and
        (($mlag1 or $mlag3) and ($eos1 or $mlag2 or $err1))
}

Suricata IDS Rule

alert udp any any -> any any (msg:"CVE-2026-73450 Arista EOS MLAG Dual Primary Detection manipulation attempt"; \
  flow:stateless; \
  content:"|00|"; depth:1; \
  threshold:type both, track by_src, count 50, seconds 10; \
  classtype:attempted-dos; \
  metadata:cve CVE-2026-73450, vendor Arista, product EOS; \
  sid:90073450; rev:1;)

Restrict this rule to the Dual Primary Detection segment via the appropriate $HOME_NET/$EXTERNAL_NET variables and, where known, the detection VLAN/port. The content byte is a placeholder; operators should capture legitimate detection traffic and build a positive signature around the unauthenticated control packets.

Elastic Detection

sequence by host.id with maxspan=5m
  [ network where network.transport in ("udp","tcp") and
      destination.ip in ("<dual-primary-detection-subnet>") and
      event.action == "network_flow" ]
  [ network where event.category == "network" and
      network.direction == "inbound" and
      source.ip in ("<dual-primary-detection-subnet>") ]

EQL template: correlate inbound control-plane traffic on the Dual Primary Detection subnet with subsequent MLAG role-change events. Replace <dual-primary-detection-subnet> with the operational detection network. Pair with an event monitoring MLAG interface state transitions from up to err-disabled.

Splunk SPL Query

index=network sourcetype=arista:eos mlag_role="secondary"
| where match(lower(dual_primary_state), "dual-primary|err-disable")
| stats count as state_events, min(_time) as first_seen, max(_time) as last_seen by host, mlag_domain, interface
| where state_events > 1
| eval cve="CVE-2026-73450", severity="medium"
| table first_seen, last_seen, host, mlag_domain, interface, state_events, cve, severity
| sort - last_seen

Splunk SPL search for anomalous MLAG secondary role state transitions consistent with CVE-2026-73450.

Wazuh OSSEC Rule

<group name="arista,mlag,cve-2026-73450,">
  <rule id="100734" level="10">
    <decoded_as>json</decoded_as>
    <field name="mlag_role">secondary</field>
    <field name="dual_primary_state" type="pcre2">dual-primary|err-disable</field>
    <description>CVE-2026-73450: Arista EOS MLAG secondary reports anomalous dual-primary state / interface err-disable</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,</group>
  </rule>

  <rule id="100735" level="12">
    <if_sid>100734</if_sid>
    <field name="interface_state">err-disabled</field>
    <description>CVE-2026-73450: MLAG interface err-disabled following suspected dual-primary state manipulation</description>
    <group>dos,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, advisory, hotfix, or fixed-version reference was located across tracked sources. No vendor fix, workaround, or affected-version list is published. Treat any remediation below as compensating control, not a patch.

1. Immediate mitigations (compensating controls only):

   • Restrict Layer 2/Layer 3 access to the Dual Primary Detection network segment to only the two MLAG peers. Use dedicated VLANs, port security (MAC limiting), and 802.1X or ACLs to prevent unauthorized hosts from joining the detection domain.
   • Where the architecture permits, isolate the Dual Primary Detection path on a physically or logically dedicated segment not reachable by general access hosts.
   • Monitor the primary MLAG switch health closely; because exploitation is conditional on a primary failure, reducing unnecessary failovers reduces the exploitation window.
   • Enable err-disable auto-recovery with conservative timers ONLY if operationally safe; otherwise ensure rapid manual recovery procedures exist to restore err-disabled MLAG interfaces.
   • Audit MLAG Dual Primary Detection configuration and consider disabling it only if an equivalent split-brain prevention mechanism is in place (do not disable blindly — dual-primary detection exists to prevent forwarding loops).

2. Patch/upgrade steps:

   • Monitor Arista's security advisory portal and the NVD entry for CVE-2026-73450 for an official fixed EOS release.
   • When a fix is published, test in a lab MLAG pair before production; upgrade both peers in a maintenance window with a documented rollback plan.
   • Because the flaw is conditionally triggered on primary failure, verify post-upgrade that simulated primary failures no longer cause the secondary to err-disable under the test conditions.

3. Long-term hardening:

   • Segment and micro-segment control-plane networks; never expose MLAG detection segments to general-purpose user or server VLANs.
   • Deploy control-plane policing (CoPP) to rate-limit unexpected traffic on the detection path.
   • Integrate MLAG state and err-disable events into SIEM with the detection rules above.
   • Include conditional-DoS L2/L3 redundancy scenarios in purple-team exercises.

References

1. NVD — CVE-2026-73450: https://nvd.nist.gov/vuln/detail/CVE-2026-73450
2. CWE-345 — Insufficient Verification of Data Authenticity: https://cwe.mitre.org/data/definitions/345.html
3. MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
4. Arista Networks Security Advisories portal (monitor for CVE-2026-73450 fix): https://www.arista.com/en/support/advisories-notices
5. CISA Known Exploited Vulnerabilities Catalog (verify status; CVE-2026-73450 is NOT currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No known campaigns, no KEV listing, no public PoC, no exploit code, and no exploit-sale evidence at time of writing. EPSS 0.00132 (3.1% percentile) indicates very low predicted exploitation likelihood in the near term, consistent with the high attack complexity and adjacency requirement.