Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.
"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24714-security-advisory-0158","tags":["vendor-advisory"]}],"configurations":[{"lang":"en","value":"In order to be vulnerable to CVE-2026-73456, gNPSI must be enabled and one of the following conditions must be met:\n\n\n\n1. A gNPSI transport is configured to perform TLS (server verification) and metadata authentication is enabled:\n\n\n\nswitch> show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, TLS configured\nAuthentication username priority: x509-spiffe, metadata, x509-common-name\n\n\n\n2. Or mTLS is enabled with x509-common-name authentication configured:\n\n\n\nswitch> show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, mutual TLS configured\nAuthentication username priority: x509-spiffe, x509-common-name\n\n\n\nSystems remain unaffected if gNPSI is not enabled (default configuration):\n\n\n\nswitch> show management api gnpsi\nEnabled: no transports enabled","supportingMedia":[{"type":"text/html","base64":false,"value":"In order to be vulnerable to CVE-2026-73456, gNPSI must be enabled and one of the following conditions must be met:
1. A gNPSI transport is configured to perform TLS (server verification) and metadata authentication is enabled:
switch> show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, TLS configured\nAuthentication username priority: x509-spiffe, metadata, x509-common-name
2. Or mTLS is enabled with x509-common-name authentication configured:
switch> show management api gnpsi\nTransport: t2\nEnabled: yes\nServer: running on port 7001\nSource: sflow\nListening VRF default: ::\nSSL profile: P2, mutual TLS configured\nAuthentication username priority: x509-spiffe, x509-common-name
Systems remain unaffected if gNPSI is not enabled (default configuration):
switch> show management api gnpsi\nEnabled: no transports enabled"}]}],"workarounds":[{"lang":"en","value":"To secure the agent against CVE-2026-73456, configure the service to use mutual TLS and enable only x509-spiffe authentication:\n\n\n\nmanagement security\n ssl profile P1\n certificate server.crt key server.key\n trust certificate ca_client.crt\n chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n transport grpc t2\n ssl profile P1\n port 7001\n authentication username priority x509-spiffe\n no disabled","supportingMedia":[{"type":"text/html","base64":false,"value":"
To secure the agent against CVE-2026-73456, configure the service to use mutual TLS and enable only x509-spiffe authentication:
management security\n ssl profile P1\n certificate server.crt key server.key\n trust certificate ca_client.crt\n chain certificate ca_signing.crt\n!\nmanagement api gnpsi\n transport grpc t2\n ssl profile P1\n port 7001\n authentication username priority x509-spiffe\n no disabled"}]}],"solutions":[{"lang":"en","value":"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73456 has been fixed in the following releases:\n\n * 4.36.2F and later releases in the 4.36.x train\n * 4.35.6M and later releases in the 4.35.x train\n * 4.34.8M and later releases in the 4.34.x train","supportingMedia":[{"type":"text/html","base64":false,"value":"
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. CVE-2026-73456 has been fixed in the following releases: