CVE-2026-73464

Executive Summary

CVE-2026-73464 is a remote code execution vulnerability in Arista EOS affecting platforms where the gRPC Network Management Interface (gNMI) is enabled. A malicious client that is authenticated with gNMI access can send a specially crafted request to execute arbitrary code with root privileges on the switch. Because exploitation requires only low-privilege authenticated access over the network and results in full compromise of confidentiality, integrity, and availability, this is a high-severity issue (CVSS 8.8) for any organization exposing gNMI-enabled EOS devices to semi-trusted or management networks.

Technical Analysis

The vulnerability is classified under CWE-94 (Improper Control of Generation of Code / "Code Injection"). According to the NVD description, the flaw resides in the gRPC Network Management Interface (gNMI) service on Arista EOS: "a specially crafted request could allow a malicious authenticated client with gRPC Network Management Interface (gNMI) access to execute arbitrary code with root privileges on the switch."

The attack surface is the gNMI management plane. gNMI is a gRPC-based protocol used for streaming telemetry and configuration management on network devices, typically exposed over TCP with transport security (gRPC/TLS). Critically, the vulnerability is not exploitable pre-authentication — the attacker must already hold valid gNMI credentials or a certificate accepted by the device. This is reflected in the CVSS vector, which assigns PR:L (Privileges Required: Low), meaning the actor needs some legitimate, low-level access before the flaw can be triggered.

What is notable about the impact profile is the privilege escalation implied by the description: a client operating within gNMI's normal authorization envelope can cause code execution as root on the underlying switch operating system. In other words, the gNMI service fails to adequately constrain the effect of a crafted request, allowing the attacker to escape the intended management-operation boundary and reach the OS execution context.

The exact parsing or handling path that yields code execution — the specific gNMI request field, RPC, parser routine, or EOS subsystem involved — is not disclosed in the NVD description or CNA title provided. Because no patch, advisory text, or PoC is available in the supplied intelligence, the precise code-level trigger cannot be asserted here. What can be stated with confidence from the data is the vulnerability class (code injection through a crafted management request) and the resulting mechanism (attacker-controlled input is transformed into executable behavior running as root). Any claim specifying a particular RPC method name, protocol buffer field, or library would be speculation and is deliberately omitted.

Because the affected component runs on the switch itself, the vulnerable attack surface is the switch control plane rather than a conventional application server. EOS devices sit at network aggregation, core, and leaf positions in data centers and campus fabrics; a root compromise of such a device is a control-plane compromise of the network fabric.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-94) and the description supplied. No specific function names, RPC endpoints, protobuf fields, or file paths are invented.

1. Reconnaissance / target identification. The attacker enumerates Arista EOS management interfaces to find devices with gNMI reachable. Practically, this means identifying hosts responding on the gRPC/gNMI management port and confirming Arista EOS as the platform (banner, certificate subject, or TLS metadata). Targets are typically found on management VLANs, out-of-band networks, or — in misconfigured environments — on routed interfaces reachable from less trusted segments.

2. Authentication / prerequisite access. The attacker must possess valid gNMI credentials (username/token or an accepted client certificate) and the network path to the gNMI service. This matches the PR:L vector: exploitation does not occur pre-authentication. Sources of such credentials include leaked service accounts, over-broad role assignments (e.g., monitoring/telemetry accounts granted gNMI access), credential reuse from compromised management systems, or a prior foothold on a management host that already talks gNMI to the device.

3. Triggering the flaw (vulnerability-class level). Once authenticated, the attacker sends a specially crafted request over the gNMI channel. Because the flaw is CWE-94 code injection, the crafted request is processed by EOS in a way that allows attacker-influenced input to be evaluated or executed rather than treated strictly as data — the intent of the request is subverted into code execution. The precise field or operation abused is not disclosed.

4. Execution and post-exploitation impact. Successful triggering yields arbitrary code execution with root privileges on the switch. Because the compromised asset is a network device, post-exploitation consequences include full read/write control of device configuration and forwarding behavior, potential access to stored secrets and routing/peering credentials, use of the device as a pivot into adjacent management or production networks, and the ability to manipulate or intercept network traffic. The CVSS subscores (C:H/I:H/A:H) indicate total loss of confidentiality, integrity, and availability on the affected component.

Impact Assessment

CVSS 3.1 base score 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Interpretation of each subscore for this case:

• AV:N (Network) — the gNMI service is reached over the network; no physical or adjacent-only access is required.
• AC:L (Low) — no special conditions beyond a well-formed crafted request and valid access are described.
• PR:L (Low) — the attacker needs authenticated gNMI access, but not administrative/root rights in advance; the vulnerability itself bridges the gap to root execution.
• UI:N (None) — no victim interaction is required.
• S:U (Unchanged) — the impact is scoped to the vulnerable component (the switch) per the vector.
• C:H/I:H/A:H — complete compromise of confidentiality, integrity, and availability of the affected device.

Blast radius. The directly impacted systems are Arista EOS switches with gNMI enabled. In a typical deployment these are core, spine, leaf, or aggregation switches, so a single compromise can have network-wide consequences: manipulation of routing adjacencies and forwarding, disruption of segmentation, and exposure of credentials stored on the device. Secondary impact extends to any host or network whose traffic transits the compromised switch, and to management infrastructure that the switch can reach. The effective precondition — possession of gNMI credentials — narrows the initial attacker population but is not a strong control in environments where telemetry/monitoring accounts are broadly distributed or where management networks are insufficiently segmented. This CVE is not listed in CISA KEV, has no known public proof-of-concept, and is not yet scored by FIRST.org EPSS as of this writing, so there is currently no evidence of exploitation in the wild.

Detection Guidance

Sigma Rule

title: Potential Arista EOS gNMI Arbitrary Code Execution Attempt (CVE-2026-73464)
id: 8f3c1d92-7a4b-4e21-9c6d-2b5e0f4a7d11
status: experimental
description: >
  Detects anomalous or malformed gNMI request activity targeting Arista EOS devices
  that may be associated with exploitation of CVE-2026-73464, a code injection flaw
  reachable by authenticated gNMI clients.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-73464
author: valtersit.com Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1190
  - cve.2026-73464
logsource:
  category: network_connection
  product: zeek
detection:
  selection_dst_port:
    id.resp_p: 6030
  selection_proto:
    proto: tcp
  selection_conn_state:
    conn_state:
      - 'S0'
      - 'REJ'
      - 'RSTO'
      - 'RSTR'
  condition: selection_dst_port and selection_proto and selection_conn_state
falsepositives:
  - Legitimate gNMI collectors reconnecting after network changes
  - Load balancer or health-check probes to gNMI endpoints
level: medium

Note: the gNMI default gRPC service is commonly exposed on TCP/6030; the port must be confirmed against the local EOS configuration before enabling this rule.

YARA Rule

rule CVE_2026_73464_EOS_gNMI_CodeInjection_Indicators
{
    meta:
        description = "Heuristic detection of artifacts potentially associated with Arista EOS gNMI code injection (CVE-2026-73464) in captured request data or logs"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-73464"
        date = "2026-01-01"
        severity = "high"

    strings:
        $s1 = "gNMI" ascii wide nocase
        $s2 = "gnmi.gNMI" ascii wide nocase
        $s3 = "grpc" ascii wide nocase
        $s4 = "/bin/sh" ascii
        $s5 = "/bin/bash" ascii
        $s6 = "exec(" ascii
        $s7 = "system(" ascii

    condition:
        (uint16(0) == 0x0a0d or true) and
        ($s1 or $s2) and
        2 of ($s4, $s5, $s6, $s7)
}

Rationale: because no patch or PoC discloses the exact malformed field, this rule flags combined indicators — gNMI protocol references together with command-execution primitives — rather than a single known signature. Tune to your environment and treat matches as suspicious, not definitive.

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 6030 (msg:"CVE-2026-73464 Arista EOS gNMI Possible Crafted Request Code Injection Attempt"; flow:established,to_server; content:"|00|"; depth:1; content:"gNMI"; nocase; content:"grpc"; nocase; content:"/bin/sh"; nocase; classtype:attempted-admin; reference:cve,2026-73464; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-73464; sid:202673464; rev:1; metadata:service grpc;)

Note: gRPC/gNMI traffic is normally protected by TLS, which limits payload inspection. This rule is meaningful only where TLS termination, cleartext gNMI, or deep-packet inspection provides visibility. The port (6030) and content matches must be validated against the actual deployment.

Elastic Detection

network where destination.port == 6030 and
  event.action == "connection_attempted" and
  network.transport == "tcp" and
  source.ip != null

Interpretation: surfaces new or unexpected sources initiating gNMI connections to EOS management endpoints. Follow-up triage should correlate by source.ip and user.name — in EOS environments successful gNMI authentication typically logs the gNMI account — and flag sources that are not known telemetry collectors. Adjust the port to match local gNMI configuration.

Splunk SPL Query

index=network OR index=eos (dest_port=6030 OR dest_port=9339)
| stats count, min(_time) as first_seen, max(_time) as last_seen by src_ip, dest_ip, dest_port
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

And for EOS-side authentication/management logging, correlate gNMI account activity with anomalous events:

index=eos sourcetype="arista:eos" (gnmi OR gRPC)
| stats count by host, user, src_ip
| where count > 0
| sort - count

Adjust index names, sourcetypes, and ports to match the environment. These queries prioritize visibility into gNMI access patterns rather than a fixed exploit signature, since no signature is publicly available.

Wazuh OSSEC Rule

<group name="arista,eos,gnmi,">
  <rule id="2026734" level="10">
    <decoded_as>json</decoded_as>
    <field name="program">gnmi</field>
    <match>error|fail|panic|crash|segfault|core dump</match>
    <description>CVE-2026-73464: Suspicious Arista EOS gNMI service error or crash - possible code injection attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="2026735" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">gnmi</field>
    <match>root|privilege|escalat</match>
    <description>CVE-2026-73464: Arista EOS gNMI privilege escalation indicator detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

These rules assume EOS syslog is forwarded to Wazuh in JSON or structured format; field names must be mapped to the actual decoder for the environment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version matrix is present in the provided intelligence. Until Arista publishes an advisory and fixed EOS release, treat all mitigations below as compensating controls and validate them against your environment.

1. Immediate mitigations

• Disable gNMI where it is not operationally required. If gNMI is not in active use, disabling the service removes the attack surface entirely and is the strongest immediate control.
• Restrict network reachability. Place the gNMI management interface on a dedicated, strictly segmented management/OOB network; enforce ACLs and firewall policy so only authorized telemetry collectors can reach the gNMI port, and deny access from user, server, and general-purpose segments.
• Enforce strong authentication and least privilege for gNMI. Audit which accounts and client certificates have gNMI access, rotate credentials, remove dormant or over-privileged accounts, and eliminate shared service accounts. Assume any gNMI-capable credential is effectively a path to root on the device until the flaw is fixed.
• Enable strict mutual TLS (mTLS) for gNMI clients where supported, and alert on new client identities.
• Increase logging and monitoring of gNMI connections and authentication events, and monitor EOS for unexpected process crashes, restarts, or watchdog events that could indicate exploitation attempts.

2. Patch/upgrade steps

• Monitor the Arista security advisory portal and the NVD entry for CVE-2026-73464 for an authoritative fix, affected-release list, and any interim workarounds. No patch reference exists in the data provided as of this report.
• When a fixed EOS release becomes available, perform a risk-ranked upgrade of gNMI-enabled devices, starting with internet-adjacent and management-exposed switches, then core/aggregation, then leaf/access.
• After upgrading, re-verify gNMI service state and re-apply the least-privilege access controls above, since configuration drift is common during maintenance.

3. Long-term hardening

• Segment management planes from production and user networks as a standing architectural control, so that a compromised management service cannot be reached laterally.
• Adopt hardware-rooted or certificate-based device identity and enforce mTLS for all gNMI/telemetry clients.
• Continuously inventory and minimize management protocols (gNMI, gRPC, NETCONF/RESTCONF, eAPI) enabled on network devices, and disable those without a documented operational need.
• Instrument network devices into the SOC: forward EOS logs, monitor management-plane authentication, and alert on anomalous management connections.
• Track Arista security advisories and NVD for this CVE and include network-device management-plane vulnerabilities in patch SLAs.
• Maintain an offline copy of device configurations and secrets-management rotations so that a compromised switch can be rebuilt without seeding credentials to the attacker.

References

• NVD — CVE-2026-73464: https://nvd.nist.gov/vuln/detail/CVE-2026-73464
• MITRE CWE-94 — Improper Control of Generation of Code ('Code Injection'): https://cwe.mitre.org/data/definitions/94.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Arista Security Advisories portal (monitor for vendor advisory and fixed EOS releases): https://www.arista.com/en/support/advisories-notices
• FIRST EPSS (currently unscored for this CVE; monitor for future scoring): https://www.first.org/epss/

Threat actor / exploit-in-the-wild evidence: none available. CVE-2026-73464 is not in CISA KEV, has no public PoC or exploit code, and no Nuclei template exists as of this writing. The report above reflects only what is stated in the NVD description and supplied metadata; all sections beyond the direct description are explicitly framed as vulnerability-class inference.