CVE-2026-73462: On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the I

Published Sep 16, 2026

Updated

On affected platforms running Arista EOS with IGMP (Internet Group Management Protocol) snooping configured (enabled by default on all VLANs), a network-adjacent unauthenticated attacker can send malformed network packets on an affected VLAN to cause the IGMP snooping agent to terminate unexpectedly. This results in a temporary disruption of multicast traffic management, which may cause multicast traffic to be flooded to all ports of the affected VLAN until the service recovers. Repeated exploitation could result in a prolonged loss of intended multicast forwarding behavior.

Affected Software

1 affected component

Arista Networks Arista EOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.33.9M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.34.8M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.35.6M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.36.2F

Event History

Sep 16, 2026

CVE Published

via MITRE·07:01 PM

Data Sourced

via MITRE·07:01 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Is IGMP snooping enabled by default on affected systems?

Yes. IGMP snooping is enabled by default on all VLANs, so VLANs using the default configuration are within the described exposure conditions.

Does an attacker need credentials or administrative access to trigger the issue?

No. The attacker is described as network-adjacent and unauthenticated, but must be able to send malformed packets on an affected VLAN.

What happens if the issue is repeatedly exploited?

Repeated malformed-packet attacks can repeatedly terminate the IGMP snooping agent and prolong the loss of intended multicast forwarding behavior. During recovery, multicast traffic may be flooded to all ports on the affected VLAN.