CVE-2026-73458CWE-303

CVE-2026-73458

High · published September 16, 2026

CVSS v3.1
8.2
EPSS
0%
Percentile
33.1
In the wild
Unconfirmed
What it is

On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various routing protocols monitor status on BFD session(s).

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:H
EPSS
0.00400 · 33.1th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2026-09-16T00:17Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24710-security-advisory-0154 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 15 SEP 19:30Z
    On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou
    cvelistv5