CVE-2026-73463

Executive Summary

CVE-2026-73463 is a race condition (CWE-362) in the gRPC Network Security Interface (gNSI) Authz service of Arista EOS. When multiple gNSI transports are configured, a policy rotation can fail silently, allowing an authenticated user whose access was revoked to retain unauthorized access to gRPC interfaces. The vulnerability carries a CVSS 3.1 base score of 5.3 (Medium) and is assessed as UNPATCHED with no public exploit, PoC, or Nuclei template available.

Technical Analysis

Arista EOS exposes a gRPC Network Security Interface (gNSI) that provides programmatic access to device interfaces. The gNSI Authz service is responsible for enforcing authorization policy on gRPC requests, including the evaluation of which authenticated principals are permitted to reach which gRPC interfaces. When multiple gNSI transports are configured simultaneously, the CVE description states that a race condition in the gNSI Authz service may cause a policy rotation to fail silently.

The core defect is a concurrency flaw: two or more transports processing a policy rotation concurrently can interleave in a way that leaves the authorization state inconsistent. Because the failure is silent, no error or alarm is raised to the operator, and the old policy (or a partially applied new policy) may continue to govern part of the gRPC surface. The practical security consequence is that an authenticated user whose access was explicitly revoked by the new policy may retain unauthorized access to gRPC interfaces.

The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) indicates the flaw is network-reachable, requires high attack complexity (consistent with a race condition that must be won), requires low privileges (a valid authenticated account), needs no user interaction, and impacts integrity only — specifically a high integrity impact on the authorization decision — with no direct confidentiality or availability impact. This maps cleanly to a broken-access-control outcome rather than a code-execution or data-exfiltration outcome.

No specific function names, API paths, transport identifiers, or policy-file paths are disclosed in the available NVD description. Analysis is therefore conducted at the vulnerability-class level: a TOCTOU-style race in an authorization policy rotation path. No further code-level details can be asserted without fabrication.

Arista states the issue was discovered internally and that the company is not aware of malicious exploitation in customer networks. The description explicitly notes that BootZ is not affected.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain below is inferred from the vulnerability class (race condition in an authorization policy rotation service) and the stated precondition of multiple gNSI transports.

1. Reconnaissance / target identification. An adversary with network reachability to the Arista EOS management surface identifies a device with gRPC enabled and multiple gNSI transports configured. This configuration state is the necessary precondition; a single-transport deployment is not described as vulnerable.

2. Credential acquisition and precondition establishment. The attacker must already hold a valid, authenticated account (PR:L). No authentication bypass is claimed by this CVE. The attacker's goal is to be holding that account at the moment an administrator performs a policy rotation that revokes the attacker's access.

3. Triggering the flaw class. The attacker times or induces concurrent gRPC activity across the multiple configured transports while an administrator rotates the authorization policy. The race window causes the gNSI Authz service to fail the rotation silently. Because the failure is not surfaced, the administrator believes the revocation succeeded.

4. Post-exploitation impact. The revoked user continues to reach gRPC interfaces that the new policy was intended to deny. Depending on the interfaces that were supposed to be revoked, this can permit unauthorized configuration or management operations through the gRPC surface. The impact is confined to integrity of the authorization decision — the attacker does not gain new credentials or execute arbitrary code through this flaw alone; they retain access they should have lost.

Because the flaw is a silent failure rather than an active exploit primitive, successful abuse depends on operational timing (a policy rotation coinciding with attacker activity across multiple transports) and on the administrator not independently verifying the applied policy.

Impact Assessment

Business impact centers on broken access control retaining stale privileges on network infrastructure. CVSS subscores: Confidentiality None, Integrity High, Availability None. The High integrity subscore reflects that the authorization decision itself — the integrity of the applied policy — can be defeated, allowing an account that should have been de-privileged to continue issuing gRPC management operations. There is no integrity impact on data and no availability impact.

Blast radius is bounded by (a) deployments running Arista EOS with gRPC enabled, (b) with multiple gNSI transports configured, and (c) where a policy rotation has occurred. Single-transport deployments and BootZ are explicitly unaffected. The realistic worst case is a former or de-scoped operator, service account, or automation principal retaining gRPC access after an administrative revocation. EPSS is 0.00199 (9.9th percentile), indicating low near-term exploitation likelihood, and CISA KEV does not list this CVE.

Detection Guidance

Sigma Rule

title: Arista EOS gNSI Authz Silent Policy Rotation Failure (CVE-2026-73463)
id: 8c1f4a72-3b6e-4d51-9f0a-2e7c5b9d4a10
status: experimental
description: Detects configuration or audit events indicating a gNSI authorization policy rotation on Arista EOS that may have failed silently due to a race condition when multiple gNSI transports are configured.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73463
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.73463
logsource:
  product: arista
  service: eos
detection:
  selection_rotation:
    message|contains:
      - 'gNSI'
      - 'Authz'
  selection_policy:
    message|contains:
      - 'policy'
      - 'rotation'
  condition: selection_rotation and selection_policy
falsepositives:
  - Legitimate successful policy rotations
  - Administrative troubleshooting of gNSI transports
level: medium

YARA Rule

rule CVE_2026_73463_Arista_EOS_gNSI_Authz
{
    meta:
        description = "Detects Arista EOS configuration/log artifacts referencing gNSI Authz policy rotation that may indicate CVE-2026-73463 exposure"
        author = "Valters IT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73463"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $gnsi = "gNSI" ascii wide nocase
        $authz = "Authz" ascii wide nocase
        $grpc  = "gRPC" ascii wide nocase
        $pol1  = "policy" ascii wide nocase
        $pol2  = "rotation" ascii wide nocase

    condition:
        filesize < 10MB and
        $gnsi and $authz and $grpc and ( $pol1 or $pol2 )
}

Suricata IDS Rule

alert tcp any any -> any 6030 (msg:"CVE-2026-73463 Arista EOS gNSI gRPC policy rotation activity"; flow:established,to_server; content:"gNSI"; nocase; content:"Authz"; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-admin; sid:202673463; rev:1; metadata:cve CVE-2026-73463, vendor Arista;)

Note: port 6030 is used as a representative gRPC service port placeholder; the actual gNSI transport port is deployment-specific and must be tuned per environment.

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where process.name != null and message like~ "*gNSI*" and message like~ "*Authz*" ]
  [ any where message like~ "*policy*" and message like~ "*rotation*" and message like~ "*fail*" ]

Splunk SPL Query

index=arista sourcetype=eos:syslog (message="*gNSI*" OR message="*gRPC*")
| search (message="*Authz*" OR message="*policy*" OR message="*rotation*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, user, message
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="arista,eos,cve-2026-73463,">
  <rule id="2026734" level="7">
    <decoded_as>json</decoded_as>
    <match>gNSI</match>
    <match>Authz</match>
    <description>CVE-2026-73463: Arista EOS gNSI Authz activity observed - possible silent policy rotation failure</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). Affected version ranges, vendor fix versions, and workarounds were not enumerated in the provided data.

1. Immediate mitigations

• Audit any Arista EOS deployment with gRPC enabled and multiple gNSI transports configured; treat these as the exposed population.
• After any authorization policy rotation, independently verify that the intended revocation actually took effect rather than relying on the rotation completing without error. Where possible, re-check effective authorization on each gNSI transport.
• Reduce the number of configured gNSI transports where operationally feasible, since the precondition is multiple transports configured.
• Restrict network reachability to the gRPC/gNSI management surface to trusted management networks only, consistent with the AV:N dimension of the vector.
• Follow Arista's advisory and vendor guidance for this CVE-RISK once published; consult Arista support for a fixed EOS release.

2. Patch / upgrade steps

• No patch reference is available from any tracked source at the time of writing. Monitor the Arista security advisory channel and the NVD entry for an updated EOS release that addresses the gNSI Authz race condition, and upgrade to that release when available. Arista states the issue was discovered internally and that it is not aware of malicious exploitation in customer networks.

3. Long-term hardening

• Adopt least-privilege gRPC authorization policies and review them after every rotation to confirm enforcement.
• Monitor gNSI Authz and gRPC administrative logs for silent policy rotation failures and for continued access by revoked principals.
• Include post-rotation verification steps in change-management procedures for EOS authorization policy changes.
• Track CVE-2026-73463 in vulnerability management until a vendor fix is available; CISA KEV does not currently list it.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73463
• Arista security advisories (vendor advisory portal): https://www.arista.com/en/support/advisories-notices
• CWE-362: Race Condition — https://cwe.mitre.org/data/definitions/362.html
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-73463 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS score page for CVE-2026-73463: https://api.first.org/data/v1/epss?cve=CVE-2026-73463

No known threat actor campaigns or exploit-in-the-wild evidence are associated with this CVE based on available data; Arista has stated it is not aware of malicious exploitation in customer networks.