CVE-2026-73460 in EOS
Summary
by MITRE • 09/16/2026
On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS LSP PDU packet can cause the IS-IS graceful restart procedure to terminate prematurely. This may result in traffic loss following a restart event.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified affects network infrastructure running Arista EOS with Intermediate System-to-Intermediate System (IS-IS) Graceful Restart enabled, exposing critical routing protocols to manipulation by unauthenticated attackers capable of injecting malformed Link State Protocol Data Units. IS-IS is a link-state routing protocol widely deployed in service provider and enterprise networks due to its scalability and fast convergence capabilities. The graceful restart mechanism within this protocol allows routers to maintain forwarding state while the control plane undergoes maintenance or recovery, ensuring that traffic continues to flow without interruption during neighbor resets. However, when an attacker injects a malformed LSP packet into the network stream, it can disrupt the delicate handshake process required for successful graceful restart negotiations between neighboring routers. This disruption causes the procedure to terminate prematurely, effectively negating the high availability benefits provided by the feature and leaving the routing infrastructure vulnerable to transient instability during maintenance windows or unexpected failures.
From a technical perspective, this flaw represents a failure in input validation within the IS-IS implementation of Arista EOS. The router fails to properly sanitize or validate specific fields within the received LSP PDU before processing them as part of the graceful restart logic. In standard network operations, routers exchange various control plane messages to establish adjacency and synchronize routing information. When a malformed packet is processed incorrectly, it can trigger internal state machine errors or resource exhaustion conditions that force the router to abort the ongoing graceful restart sequence. This premature termination means that if one side of an IS-IS neighbor relationship resets while relying on graceful restart for continuity, the other side may not receive the expected signals indicating that forwarding should be maintained. Consequently, the adjacency may flap or reset entirely, leading to a loss of routing information and subsequent traffic blackholing until normal convergence occurs through standard hello exchanges and database synchronization processes.
The operational impact of this vulnerability is significant in environments where network uptime is paramount. Service providers and large enterprises rely on IS-IS for core routing stability, often configuring graceful restart to minimize service disruption during software upgrades or hardware replacements. If an attacker can exploit this flaw, they do not need authentication credentials, making it a remote unauthenticated attack vector that could be executed by anyone with access to the network segment where IS-IS adjacencies are established. The primary consequence is traffic loss following any event that triggers a restart of the IS-IS process on affected devices. This includes planned maintenance activities as well as unplanned outages caused by bugs, power cycles, or other failures. During these periods, customers may experience connectivity issues, increased latency due to suboptimal routing paths selected after convergence, or complete loss of service depending on the redundancy architecture in place. The inability to maintain forwarding state during restarts undermines the reliability guarantees expected from modern network operating systems and can lead to cascading failures if multiple routers are affected simultaneously through targeted injection attacks.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. Administrators should apply vendor-provided software updates that address this specific flaw in IS-IS LSP processing as soon as they become available, ensuring that the input validation mechanisms are corrected to reject malformed packets without disrupting valid control plane operations. In environments where patching is not immediately feasible, network segmentation and access control lists can be employed to restrict who or what devices can send IS-IS protocol messages, thereby limiting exposure to unauthenticated injection attempts. Additionally, disabling graceful restart on interfaces that do not strictly require it may reduce the attack surface, although this comes at the cost of reduced availability during legitimate maintenance events. Security teams should also monitor network telemetry for anomalies in control plane traffic patterns that might indicate active exploitation attempts, such as sudden spikes in malformed packet reception or unexpected adjacency flaps correlated with specific source addresses.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories related to improper input validation and potential denial of service conditions. Specifically, it reflects weaknesses where software fails to validate data before processing it, leading to unintended behavior such as state machine corruption or resource exhaustion. In the context of the MITRE ATT&CK framework, this exploit falls under techniques involving protocol manipulation and potentially impacts availability by disrupting critical network services. The lack of authentication requirement makes it particularly dangerous in shared media environments like Ethernet LANs where broadcast domains allow any connected device to inject packets into the routing protocol stream unless strict port security or MAC filtering is implemented at Layer 2. Understanding these technical nuances allows security professionals to better defend against similar vulnerabilities across different vendors and protocols, emphasizing the importance of robust input validation and defense-in-depth strategies in network infrastructure design.