{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75944", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-08-18T16:04:11.105Z", "datePublished": "2026-09-14T22:19:19.963Z", "dateUpdated": "2026-09-14T23:06:13.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-09-14T22:19:19.963Z"}, "title": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User", "datePublic": "2026-09-09T22:13:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-459", "description": "CWE-459 Incomplete Cleanup", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.36.0", "lessThanOrEqual": "4.36.1F", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.\n</pre>"}]}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"}], "configurations": [{"lang": "en", "value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n * 802.1X (dot1x in the CLI) must be configured with pae authenticator\u00a0\n\n\n * port-control must be set to auto mode\u00a0\n\n\n * A static or dynamic ACL must be configured.\u00a0\n\n\n * The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n\u00a0\n\n\n\nBelow is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n \ninterface Ethernet5\n\u00a0\u00a0\u00a0switchport mode trunk\n\u00a0\u00a0\u00a0spanning-tree portfast edge\n dot1x pae authenticator\n\u00a0\u00a0\u00a0dot1x port-control auto\n \ndot1x system-auth-control\n\n\n\u00a0\n\n\n\nIn this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.\n\n\n\nconfig)#show\u00a0 dot1x\u00a0 interface\u00a0 ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n\n\n\u00a0\n\n\n\n\u00a0 Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n\u00a0\n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary\u00a0\nIP Access List EMPLOYEE-ACL\n\u00a0\u00a0\u00a010 permit ip 10.0.0.0/8 any\n\u00a0\u00a0\u00a020 deny ip any any\n \n\u00a0\u00a0\u00a0Total rules configured: 2\n\u00a0\u00a0\u00a0Configured on Ingress: Ethernet5\n\u00a0\u00a0\u00a0Active on Ingress: Ethernet5", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre><p>In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:</p><ol><li>802.1X (dot1x in the CLI) must be configured with <b>pae authenticator</b><div>&nbsp;</div></li><li>port-control must be set to auto mode<div>&nbsp;</div></li><li>A static or dynamic ACL must be configured.<div>&nbsp;</div></li><li>The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule</li></ol><div>&nbsp;</div><p>Below is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.</p><pre>switch(config-if-et1)#show active\n \ninterface Ethernet5\n&nbsp;&nbsp;&nbsp;switchport mode trunk\n&nbsp;&nbsp;&nbsp;spanning-tree portfast edge\n dot1x pae authenticator\n&nbsp;&nbsp;&nbsp;dot1x port-control auto\n \ndot1x system-auth-control\n</pre><div>&nbsp;</div><p>In this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.</p><pre>config)#show&nbsp; dot1x&nbsp; interface&nbsp; ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n</pre><div>&nbsp;</div><p>&nbsp; Use a preconfigured ACL with which the RADIUS server returns in the <b>Filter-Id</b> AVP</p><pre>switch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n</pre><div>&nbsp;</div><p>AAA server will return the ACL name through <b>Filter-Id</b> AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.</p><p>To verify the configured ACL, execute the following show command to identify the ACL applied to the interface:</p><pre>switch(config)#show ip access-lists interface Ethernet5 summary&nbsp;\nIP Access List EMPLOYEE-ACL\n&nbsp;&nbsp;&nbsp;10 permit ip 10.0.0.0/8 any\n&nbsp;&nbsp;&nbsp;20 deny ip any any\n \n&nbsp;&nbsp;&nbsp;Total rules configured: 2\n&nbsp;&nbsp;&nbsp;Configured on Ingress: Ethernet5\n&nbsp;&nbsp;&nbsp;Active on Ingress: Ethernet5&nbsp;</pre></pre>"}]}], "workarounds": [{"lang": "en", "value": "There is no workaround available for CVE-2026-75944.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>\nThere is no workaround available for CVE-2026-75944.\n</pre>"}]}], "solutions": [{"lang": "en", "value": "CVE-2026-75944 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<pre>\nCVE-2026-75944 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.\n</pre>"}]}], "credits": [{"lang": "en", "value": "Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.", "type": "finder"}], "source": {"advisory": "Security Advisory 0150", "discovery": "INTERNAL", "defects": ["BUG 1697612"]}, "x_generator": {"engine": "Vulnogram 1.0.5"}, "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 2.6, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 5.6, "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T23:06:11.210257Z", "id": "CVE-2026-75944", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T23:06:13.719Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThanOrEqual": "4.36.1F", "status": "affected", "version": "4.36.0", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect."}], "id": "CVE-2026-75944", "lastModified": "2026-09-14T23:18:35.760", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 2.6, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 1.4, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}]}, "published": "2026-09-14T23:18:35.760", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{}