# CVE-2026-73440: Security Advisory 0178

Status: published. Published: 2026-09-16. Updated: 2026-11-08.

On affected platforms running Arista EOS with Simple Network Management Protocol (SNMP) configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value within the device's running and sanitized configurations. An authenticated user who gains access to this sensitive information could leverage it to perform unauthorized read operations on SNMP tables or to send fraudulent trap notifications to the Network Management System (NMS).



This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

## Remediation

- fix: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.



Following the system upgrade, users are required to execute the syntax conversion command specified below to adopt the updated, encrypted SNMPv3 CLI format:



switch# configure convert new-syntax



The updated encrypted SNMPv3 CLI configuration follows this structure, incorporating the newly introduced "key <algo> <encrypted_text>" syntax:



switch# show running-config | grep snmp-server
snmp-server user alice group_alice v3 localized f5717f2cdde9bb946d00 auth sha256 key 7 005D110205085E520B754E1B591C504542585F557D2F217064607A10034752035500080755575640440F5C00505053515F08525208035C1605525E0A040E781F4D



CVE-2026-73440 has been fixed in the following releases:

  *  4.36.3M and later releases in the 4.36.x train
  *  4.35.7M and later releases in the 4.35.x train
  *  4.34.9M and later releases in the 4.34.x train
  *  4.33.11M and later releases in the 4.33.x train (source: CNA: Arista)
- workaround: CVE-2026-73440 can be remediated using the hotfix detailed below. This hotfix is strictly applicable to the listed releases. All non-listed versions must be upgraded to a fixed release as specified above.

 

  *  4.36.2F
  *  4.35.6M
  *  4.34.8M
  *  4.33.10M




Post hotfix installation, users are required to execute the syntax conversion command to fix the malformed keys.



Note: Installing/uninstalling the SWIX will cause the ConfigAgent process to restart.

Version: 1.0
URL:  SecurityAdvisory178_CVE-2026-73440_Hotfix.swix https://www.arista.com/support/advisories-notices/sa-download/ 



SWIX hash:
8a11df104d6ada97f0d63ca87a6a03071524038af1f8cd4a0bbcba490ab80245c7b2cfb86be81c5e6773e05801f3df098120f6053b130938230c79193386fe74

 



For instructions on installation and verification of the hotfix patch, refer to the “ managing eos extensions https://www.arista.com/en/um-eos/eos-managing-eos-extensions ” section in the EOS User Manual. Ensure that the patch is made persistent across reboots by running the command ‘copy installed-extensions boot-extensions’. (source: CNA: Arista)

## Affected products and versions

- Arista Networks / EOS: ≥ 4.36.0F; ≤ 4.36.2F (affected, custom); ≥ 4.35.0F; ≤ 4.35.6M (affected, custom); ≥ 4.34.0F; ≤ 4.34.8M (affected, custom); ≥ 4.33.0F; ≤ 4.33.10M (affected, custom); ≥ 1.0.0; < 4.33.0F (affected, custom). Source: CNA: Arista; platforms: 710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7150 Series, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance

## Severity and prioritization

- CVSS 3.1: 4.2 (medium); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N; source: CNA: Arista

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N; source: CNA: Arista

- CVSS 4.0: 2.3 (low); CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: psirt@arista.com

- CVSS 3.1: 4.2 (medium); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N; source: NVD: psirt@arista.com

- CISA KEV: No listing in collected sources

- EPSS: 0.27% as of 2026-11-07; percentile 18.87%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-212

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178 (CNA: Arista; vendor-advisory)

- https://www.arista.com/en/support/advisories-notices/security-advisory/24734-security-advisory-0178 (psirt@arista.com)

## Provenance

- CNA: Arista: https://www.cve.org/CVERecord?id=CVE-2026-73440; retrieved 2026-11-08; source updated 2026-11-08

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-73440; retrieved 2026-11-08; source updated 2026-11-08

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-73440; retrieved 2026-11-08; source updated Not reported

Revision: 22ba1b0acc869a61c42d591bdd3143d96c416f80400ed2eeac807df0fc506c3b

Canonical: https://y2.dev/cve/CVE-2026-73440

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.