Arista EOS gNPSI flaws enable code injection
Arista patched two EOS vulnerabilities in gNPSI processing that can allow unauthenticated code injection and plaintext credential leakage in logs.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Arista has released updates for its EOS switch platform addressing two vulnerabilities related to the gNPSI (gRPC Network Packet Streaming Interface) service. CVE-2026-73456 is a code injection flaw in the handling of gNPSI requests: an unauthenticated attacker with network access to the gNPSI service can send a specially crafted request to execute arbitrary code, potentially gaining full administrative control over the affected switch. This is only exploitable when gNPSI is enabled together with specific TLS and authentication configurations.
CVE-2026-73457 is an information-disclosure issue where gNPSI client credentials, including passwords, can be written in plaintext to local or remote accounting logs. An attacker with sufficient privileges to access those logs could read the exposed credentials. According to Arista, exploitation requires gNPSI to be enabled and the EosRpcAuth trace facility to be explicitly activated.
gNPSI is disabled by default, meaning switches running factory/default configurations are not vulnerable to either issue. There is no indication of in-the-wild exploitation; this is a vendor-issued patch advisory. Defenders running Arista EOS should check whether gNPSI is enabled and, if so, apply the vendor updates, review TLS/authentication settings for the service, and audit accounting logs for exposed plaintext credentials, disabling the EosRpcAuth trace facility unless required.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0366.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs