CVE-2026-73459: On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially…
CVE-2026-73459 analysis covering impact, affected products, versions, remediation, and cross-checked defender guidance.
CVE-2026-73459 is a vulnerability published by NVD on 9/16/2026.
What happened
On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU can cause the legitimate LSP to be unexpectedly purged from the IS-IS link-state database. This may result in traffic loss.
Affected products and versions
- NVD has not published a normalized affected-product configuration yet.
Severity and weakness
CVSS: HIGH 7.4. Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H.
Weaknesses: CWE-354.
Known exploitation
No CISA KEV entry is currently attached to the NVD record.
What defenders should do
- Identify whether the affected product and version range exists in production.
- Review vendor advisories and release notes before change windows.
- Patch, upgrade, disable the vulnerable component, or apply vendor mitigations.
- Verify the running version after deployment, not only the package inventory.
Official and supporting references
- No vendor advisory tagged by NVD at draft time.