CVE-2026-73456

Arista EOS switches running with the gRPC Network Packet Sampling Interface (gNPSI) enabled contain a code-injection flaw (CWE-94) that lets an unauthenticated remote gNPSI client execute arbitrary code by sending a crafted request. Exploitation depends on certain circumstances being met (reflected in the CVSS 4.0 Attack Requirements metric), notably that the gNPSI service is enabled and reachable on the affected platform. A successful attacker gains full administrative control over the compromised switch. Only deployments of Arista EOS with gNPSI enabled are affected; the issue was assigned by Arista's own PSIRT and carries a critical 9.2 CVSS 4.0 score. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation has been reported.

What to do: Audit EOS devices for gNPSI; if it is not required, disable it, and where it is required restrict the gRPC endpoint with management ACLs so only trusted hosts can reach it. No fixed EOS version is listed in the source data — monitor the Arista PSIRT advisory for patched releases and upgrade as soon as one is available. Verify that the gNPSI/gRPC listener is not exposed on untrusted or internet-facing networks as an interim mitigation.