CVE-2026-73444 — MEDIUM (4.7)

Vulnerability Description

On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the virtual router master role, enabling the attacker to intercept, modify, or discard traffic that hosts on the segment send to the virtual gateway address.

CVSS Score

4.7

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Related Weaknesses (CWE)

CWE-303

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24713-sec

FAQ

What is CVE-2026-73444?

CVE-2026-73444 is a vulnerability with a CVSS score of 4.7 (MEDIUM). On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is...

How severe is CVE-2026-73444?

CVE-2026-73444 has been rated MEDIUM with a CVSS base score of 4.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-73444?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.