Arista EOS CVE-2026-73450: Unauth MLAG Dual-Primary State Interference

Arista Security Advisory 0161 Executive Summary Vulnerability Overview CVE ID: CVE-2026-73450 CVSS v3.1 Base Score: 6.9 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H) CVSS v4.0 Base Score: 7 (CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/V:C/N/V:L/V:A/H/SC:N/SI:N/SA:H) Vulnerability Type: Insufficient Data Authenticity Verification (CWE-345) Description: On affected platforms configured with MLAG Dual Primary Detection, an unauthenticated attacker with network access to the Dual Primary detection network can send crafted packets to interfere with the dual-primary state. If the MLAG primary switch fails, the secondary switch will erroneously enter the dual-primary state and disable its interfaces, resulting in traffic disruption. Discovery Method: Discovered internally by Arista. The company has not received reports of this vulnerability being exploited in customer networks. Scope of Impact Affected Software (EOS Versions) 4.36.1F and earlier versions in the 4.36.x series 4.35.5M and earlier versions in the 4.35.x series 4.34.7.1M and earlier versions in the 4.34.x series 4.33.9M and earlier versions in the 4.33.x series All earlier versions Affected Platforms Arista EOS series products: 710, 7200, 720XP/722XPM, 750X, 7010TX, 7020R/R4, 7130 series 7170 series, 7050X3/X4, 7060X/X2/X4/X5/X6, 7260X/X3, 7280R/R2/R3/R4, 7300X/X3, 7320X, 7368X4, 7358X4, 7388X5, 7500R/R3/R5, 7000R4, 7700R4, AWE 5000, AWE 7200R, CloudEOS, CEOS-lab, VEOS-lab, CloudVision Exchange (virtual or physical devices) Unaffected Products/Platforms Wi-Fi Access Points CloudVision CUE (virtual/physical devices, service delivery) CloudVision Portal (virtual/physical devices) CloudVision Appliance (software, service delivery) CloudVision as-a-Service CloudVision AGN (virtual/physical devices, service delivery) Arista 7130 series running MDS Arista Converged Cloud Fabric (formerly Big Switch BCF) DANZ Monitoring Fabric (DMF): Controller, Service Node, Recorder Node, Analytics Node Arista Network Detection and Response (NDR) Security Platform (formerly Awake NDR) Arista Edge Threat Management - Arista NG Firewall and Arista Micro Edge (formerly Untangle) Arista NetVisor OS, Aruba NetVisor UNUM, Insight Analytics (formerly Flomble) VeloCloud Orchestrator (formerly VeloCloud Orchestrator by Broadcom) VeloCloud Gateway (formerly VeloCloud Gateway by Broadcom) VeloCloud Edge (formerly VeloCloud Edge by Broadcom) Configuration Required to Trigger Vulnerability 1. MLAG must be configured 2. domain-id and peer-link must be active 3. UDP heartbeat peer address must be configured 4. Dual-primary detection must be configured with Both peers must have this configuration applied to be vulnerable. Exploitation/POC Code Example of vulnerable configuration: command output displaying vulnerable configuration: Command output showing the secondary peer entering dual-primary detection state: Command output showing interfaces being errdisabled: Command output showing the primary peer becoming inactive: Messages that may appear in Syslog: Mitigation Measures Restrict access to the MLAG heartbeat interface by configuring Access Control Lists (ACLs) to allow traffic only from the specified peer addresses. Rules to be inserted at the top of the VRF inbound ACL: Configuration example (Applying ACL to the management VRF): Apply ACL to the management VRF: Verification commands: Remediation No Hotfix Available: There is no hotfix for this vulnerability. Upgrade Recommendation: Customers are advised to upgrade to the fixed versions at their earliest convenience. Fixed Versions: - 4.36.2F and subsequent versions in the 4.36.x series - 4.35.6M and subsequent versions in the 4.35.x series - 4.34.8M and subsequent versions in the 4.34.x series - 4.33.10M and subsequent versions in the 4.33.x series

Goal Reached Thanks to every supporter — we hit 100%!

Arista EOS CVE-2026-73450: Unauth MLAG Dual-Primary State Interference