CVE-2026-73442: On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving for

Published Sep 16, 2026

Updated

On affected platforms running Arista EOS with VRRP enabled, the peer device VRRP authentication credentials are logged in cleartext on the switch, allowing an authenticated user with sufficient privileges to view agent trace logs (or a system receiving forwarded log output) to obtain the peer device VRRP authentication credentials without having access to the network segment on which VRRP is running.

Affected Software

1 affected component

Arista Networks Arista EOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.33.10M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.34.8M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.35.6M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.36.2F

Event History

Sep 16, 2026

CVE Published

via MITRE·06:50 PM

Data Sourced

via MITRE·06:50 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Who can obtain the exposed VRRP credentials?

An authenticated user with sufficient privileges to view agent trace logs can obtain them. A system receiving forwarded log output can also receive the credentials in cleartext.

Is access to the VRRP network segment required?

No. The credentials can be obtained from local agent trace logs or forwarded log output without access to the network segment where VRRP is running.

Which deployments are affected?

The issue applies to affected platforms running Arista EOS with VRRP enabled.