CVE-2026-73465
On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when specialized non-standard debugging trace levels are explicitly enabled. To exploit these vulnerabilities, a malicious actor must already possess authenticated local administrative access to the device shell, and specialized non-standard debugging trace levels must be explicitly enabled. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.3
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:P/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
- EPSS probability
- 0.09%
- CWE
- CWE-532
- Published
- 2026-09-15
- Last modified
- 2026-09-17
Affected products
- Arista Networks EOS
- Arista Networks EOS
- Arista Networks EOS
- Arista Networks EOS
- Arista Networks EOS
Weakness type
Related vulnerabilities
- CVE-2026-22778 — vLLM leaks a heap address when PIL throws an error
- CVE-2025-14437 — Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
- CVE-2026-5128 — A sensitive information exposure vulnerability exists in ArthurFiorette steam-trader 2.1.1. An unauthenticated attacker
- CVE-2026-25813 — PlaciPy Exposes Sensitive Data via Application Logs
- CVE-2026-23493 — Pimcore ENV Variables and Cookie Informations are exposed in http_error_log
- CVE-2026-82434 — Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
- CVE-2026-49200 — Acer Wave 7 router: Broken Access Control
- CVE-2026-9699 — Mattermost Agents plugin logs unsanitized OpenAI API keys on authentication errors