Secuno
ENNL
Book demo

CVE-2026-73437

9.6 CRITICAL
  1. Published15 Sept 2026

Description

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper address, and the relay agent would forward it to clients without validating the source. This could allow the attacker to supply clients with malicious network configuration parameters, potentially resulting in traffic interception or denial of service for affected clients.

CVSS 3.1 breakdown

Attack vectorAdjacent
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-541678.2
Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source…
CVE-2026-571228.6
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the WhatsApp and Linear bot…
CVE-2026-541748.3
melange allows users to build apk packages using declarative pipelines. Apko prior to…
CVE-2026-801729.8
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application…
CVE-2026-854359.1
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST…
CVE-2026-854349.1
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before…

Frequently asked

Is CVE-2026-73437 being actively exploited?

CVE-2026-73437 is not in the CISA KEV catalog.

How severe is CVE-2026-73437?

CVE-2026-73437 has a CVSS 3.1 base score of 9.6, rated critical.

How do I fix CVE-2026-73437?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-73437 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.