How severe is CVE-2026-73446?

CVE-2026-73446 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2026-73446 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.

How do I fix CVE-2026-73446?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2026-73446 published?

CVE-2026-73446 was published on 2026-09-16.

CVE-2026-73446

CVE-2026-73446 is a high-severity vulnerability with a CVSS 3.x base score of 7.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-696.

Key facts

Severity: High (CVSS 3.x base score 7.4)
CVSS v4: 7.0
EPSS exploit prediction: 0% (17th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-696
Published: 2026-09-16
Last modified: 2026-09-16

Description

On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.

Frequently asked questions

What is CVE-2026-73446?: On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-IS Hello Protocol Data Unit (PDU) that causes the device to tear down an established IS-IS adjacency. This may result in traffic disruption and loss of IP reachability for prefixes advertised through that adjacency.
How severe is CVE-2026-73446?: CVE-2026-73446 has a CVSS 3.x base score of 7.4, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2026-73446 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (17th percentile), an estimate of the probability of exploitation in the next 30 days.
How do I fix CVE-2026-73446?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2026-73446 published?: CVE-2026-73446 was published on 2026-09-16.

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24716-security-advisory-0160

Other CWE-696 vulnerabilities

CVE-2026-44108 — Critical (CVSS 9.8): Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system…
CVE-2026-14169 — High (CVSS 8.1): Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted…
CVE-2026-45033 — High (CVSS 7.8): GitHub Copilot CLI brings AI-powered coding assistance directly to your command line. Prior to 1.0.43, a security…
CVE-2025-31485 — High (CVSS 7.5): API Platform Core is a system to create hypermedia-driven REST and GraphQL APIs. Prior to 4.0.22 and 3.4.17, a GraphQL…
CVE-2021-22569 — High (CVSS 7.5): An issue in protobuf-java allowed the interleaving of com.google.protobuf.UnknownFieldSet fields in such a way that…
CVE-2021-31379 — High (CVSS 7.5): An Incorrect Behavior Order vulnerability in the MAP-E automatic tunneling mechanism of Juniper Networks Junos OS…

Browse all CWE-696 vulnerabilities →