CVE-2026-73467 (GCVE-0-2026-73467)
Vulnerability from cvelistv5 – Published: 2026-09-15 18:44 – Updated: 2026-09-16 15:51
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
Summary
On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 03:57 UTC
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.1F
(custom)
Affected: 4.35.0 , ≤ 4.35.4M (custom) Affected: 4.34.0 , ≤ 4.34.7M (custom) Affected: 0.0.0 , ≤ 4.33.9M (custom) Affected: 0 , ≤ 4.32.0 (custom) Affected: 0 , ≤ 4.31.0 (custom) |
guessed |
Date Public
2026-09-09 18:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73467",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T03:57:06.873994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:51:26.451Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.4M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.32.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.31.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to CVE-2026-73467, the following condition must be met:\u003c/p\u003e\u003cp\u003eTacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword \u201cTacacs\u201d. The level from the output can be 6 or any range that includes 6, e.g. \u201c0-7\u201d or \u201c*\u201d.\u003c/p\u003e\u003cp\u003eThis is an example showing the trace setting \u201cTacacs*\u201d with level with \u201c0-7\u201d, which will leak the password:\u003c/p\u003e\u003cpre\u003eswitch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7\u003c/pre\u003e\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73467, the following condition must be met:\n\n\n\nTacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword \u201cTacacs\u201d. The level from the output can be 6 or any range that includes 6, e.g. \u201c0-7\u201d or \u201c*\u201d.\n\n\n\nThis is an example showing the trace setting \u201cTacacs*\u201d with level with \u201c0-7\u201d, which will leak the password:\n\n\n\nswitch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Impact on DANZ Monitoring Fabric (DMF)\u003cp\u003eDANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.\u003c/p\u003e\u003cp\u003eDMF fabric switches running Switch Light OS are not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eCustomers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.\u003c/p\u003e\u003cpre\u003eDMF-CONTROLLER\u0026gt; show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; True\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; True\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; False \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; x86_64-ccs-720df-48y-eos\u003c/pre\u003e"
}
],
"value": "Impact on DANZ Monitoring Fabric (DMF)\n\nDANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.\n\n\n\nDMF fabric switches running Switch Light OS are not affected by this vulnerability.\n\n\n\nCustomers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.\n\n\n\nDMF-CONTROLLER\u003e show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 False \u00a0 \u00a0 \u00a0 \u00a0 x86_64-ccs-720df-48y-eos"
}
],
"datePublic": "2026-09-09T18:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eOn affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers\n\u003c/pre\u003e"
}
],
"value": "On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers"
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:44:39.048Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Security Advisory 0153",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\nCVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.\n\u003c/pre\u003e"
}
],
"value": "CVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train."
}
],
"source": {
"advisory": "Security Advisory 0153",
"defects": [
"BUG 1595862",
"BUG 1966285 (DMF)"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eThe workaround is to disable Tacacs level 6 tracing on agent Aaa.\u003c/p\u003e\u003cpre\u003eswitch(config)# no trace Aaa enable Tacacs levels 6\u003cbr\u003e\u003cbr\u003eClean Up Existing Log Files\u003cp\u003eIf any of the above agent logging levels have been enabled, it\u2019s necessary to clean up the existing log files to remove the already leaked secrets and keys.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up Aaa or ConfigAgent log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027Aaa*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027ConfigAgent*.gz\u0027 -type f -delete\u003c/pre\u003e\u003c/pre\u003e\u003c/pre\u003e"
}
],
"value": "The workaround is to disable Tacacs level 6 tracing on agent Aaa.\n\n\n\nswitch(config)# no trace Aaa enable Tacacs levels 6\n\nClean Up Existing Log Files\n\nIf any of the above agent logging levels have been enabled, it\u2019s necessary to clean up the existing log files to remove the already leaked secrets and keys.\n\n\n\nUse the following commands to clean up Aaa or ConfigAgent log files:\n\n\n\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\n\n\n\u00a0\n\n\n\nThen use the following commands to clean up previously rotated old log files:\n\n\n\nswitch(config)# bash sudo find /var/log/agents -name \u0027Aaa*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027ConfigAgent*.gz\u0027 -type f -delete"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73467",
"datePublished": "2026-09-15T18:44:39.048Z",
"dateReserved": "2026-08-12T16:47:18.121Z",
"dateUpdated": "2026-09-16T15:51:26.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-73467",
"date": "2026-09-30",
"epss": "0.00132",
"percentile": "0.02297"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.4M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.32.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.31.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"source": "psirt@arista.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers"
}
],
"id": "CVE-2026-73467",
"lastModified": "2026-09-16T19:09:28.447",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.3,
"impactScore": 5.9,
"source": "psirt@arista.com",
"type": "Secondary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.0,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "psirt@arista.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-73467",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T03:57:06.873994Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-15T19:17:39.477",
"references": [
{
"source": "psirt@arista.com",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153"
}
],
"sourceIdentifier": "psirt@arista.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-532"
}
],
"source": "psirt@arista.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-73467",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-16T03:57:06.873994Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-16T15:42:28.903Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.1F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.4M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.9M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.32.0",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.31.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to CVE-2026-73467, the following condition must be met:\u003c/p\u003e\u003cp\u003eTacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword \u201cTacacs\u201d. The level from the output can be 6 or any range that includes 6, e.g. \u201c0-7\u201d or \u201c*\u201d.\u003c/p\u003e\u003cp\u003eThis is an example showing the trace setting \u201cTacacs*\u201d with level with \u201c0-7\u201d, which will leak the password:\u003c/p\u003e\u003cpre\u003eswitch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7\u003c/pre\u003e\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-73467, the following condition must be met:\n\n\n\nTacacs trace level 6 on agent Aaa must be enabled. The trace setting can be any regex that matches the keyword \u201cTacacs\u201d. The level from the output can be 6 or any range that includes 6, e.g. \u201c0-7\u201d or \u201c*\u201d.\n\n\n\nThis is an example showing the trace setting \u201cTacacs*\u201d with level with \u201c0-7\u201d, which will leak the password:\n\n\n\nswitch# show run section trace | grep Aaa\ntrace Aaa setting Tacacs*/0-7"
},
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Impact on DANZ Monitoring Fabric (DMF)\u003cp\u003eDANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.\u003c/p\u003e\u003cp\u003eDMF fabric switches running Switch Light OS are not affected by this vulnerability.\u003c/p\u003e\u003cp\u003eCustomers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.\u003c/p\u003e\u003cpre\u003eDMF-CONTROLLER\u0026gt; show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; True\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; True\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; False \u0026nbsp; \u0026nbsp; \u0026nbsp; \u0026nbsp; x86_64-ccs-720df-48y-eos\u003c/pre\u003e"
}
],
"value": "Impact on DANZ Monitoring Fabric (DMF)\n\nDANZ Monitoring Fabric (DMF) deploys a fixed version of Arista EOS on certain managed fabric switches. If the EOS version bundled with a DMF release falls within the affected version range of this advisory, DMF deployments using EOS-based switch platforms may be impacted.\n\n\n\nDMF fabric switches running Switch Light OS are not affected by this vulnerability.\n\n\n\nCustomers running DMF should run the following command on the controller to identify the EOS version bundled with their deployment.\n\n\n\nDMF-CONTROLLER\u003e show version details\n...\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Platform files ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nFile\nHcl supported Platform\n-------------------------------------------------------------------------------------|-------------|------------------------------|\n...\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 x86_64-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 True\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 i686-7289-eos\nEOS-4.36.2F-49446791.volgarel.1-x86_64.swi\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 False \u00a0 \u00a0 \u00a0 \u00a0 x86_64-ccs-720df-48y-eos"
}
],
"datePublic": "2026-09-09T18:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eOn affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers\n\u003c/pre\u003e"
}
],
"value": "On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers"
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:44:39.048Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"name": "Arista Security Advisory 0153",
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24709-security-advisory-0153"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\nCVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.\n\u003c/pre\u003e"
}
],
"value": "CVE-2026-73465 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.5M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train."
}
],
"source": {
"advisory": "Security Advisory 0153",
"defects": [
"BUG 1595862",
"BUG 1966285 (DMF)"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eThe workaround is to disable Tacacs level 6 tracing on agent Aaa.\u003c/p\u003e\u003cpre\u003eswitch(config)# no trace Aaa enable Tacacs levels 6\u003cbr\u003e\u003cbr\u003eClean Up Existing Log Files\u003cp\u003eIf any of the above agent logging levels have been enabled, it\u2019s necessary to clean up the existing log files to remove the already leaked secrets and keys.\u003c/p\u003e\u003cp\u003eUse the following commands to clean up Aaa or ConfigAgent log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThen use the following commands to clean up previously rotated old log files:\u003c/p\u003e\u003cpre\u003eswitch(config)# bash sudo find /var/log/agents -name \u0027Aaa*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027ConfigAgent*.gz\u0027 -type f -delete\u003c/pre\u003e\u003c/pre\u003e\u003c/pre\u003e"
}
],
"value": "The workaround is to disable Tacacs level 6 tracing on agent Aaa.\n\n\n\nswitch(config)# no trace Aaa enable Tacacs levels 6\n\nClean Up Existing Log Files\n\nIf any of the above agent logging levels have been enabled, it\u2019s necessary to clean up the existing log files to remove the already leaked secrets and keys.\n\n\n\nUse the following commands to clean up Aaa or ConfigAgent log files:\n\n\n\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/Aaa*\nswitch(config)# bash sudo truncate -s 0 /var/log/agents/ConfigAgent*\n\n\n\u00a0\n\n\n\nThen use the following commands to clean up previously rotated old log files:\n\n\n\nswitch(config)# bash sudo find /var/log/agents -name \u0027Aaa*.gz\u0027 -type f -delete\nswitch(config)# bash sudo find /var/log/agents -name \u0027ConfigAgent*.gz\u0027 -type f -delete"
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-73467",
"datePublished": "2026-09-15T18:44:39.048Z",
"dateReserved": "2026-08-12T16:47:18.121Z",
"dateUpdated": "2026-09-16T15:51:26.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…