What’s Vulnerable › Vulnerabilities
CVE-2026-77191: All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an
- Severity: low (CVSS 2.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-14 · updated 2026-09-16
- Weakness: CWE-862
Description
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.
Affected products
- Arista Networks EOS: from 4.35.0 through 4.35.0.3F; from 4.34.0 through 4.34.5M; through 4.33.7.1M
References
Get alerted when CVE-2026-77191 or the next vulnerability affects your stack