Description
On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled.

To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Published: 2026-09-15
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

Vendor Solution

CVE-2026-73465 has been fixed in the following releases: * 4.36.2F and later releases in the 4.36.x train. * 4.35.5M and later releases in the 4.35.x train. * 4.34.8M and later releases in the 4.34.x train. * 4.33.10M and later releases in the 4.33.x train.

Vendor Workaround

The workaround is to disable PyServer level 4 tracing on agent Aaa. switch(config)# no trace Aaa enable PyServer levels 4

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 15 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 19:00:00 +0000

Type Values Removed Values Added
Description On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Title On affected platforms running Arista EOS, under certain circumstances plaintext user passwords
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 6.3, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Arista

Published:

Updated: 2026-09-15T19:27:47.250Z

Reserved: 2026-08-12T16:47:18.121Z

Link: CVE-2026-73466

cve-icon Vulnrichment

Updated: 2026-09-15T19:27:42.731Z

cve-icon NVD

Status : Received

Published: 2026-09-15T19:17:39.337

Modified: 2026-09-15T20:17:44.323

Link: CVE-2026-73466

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File