EUVD-2026-78213
GHSA-h9qv-gg29-5v6f
Severity by source
CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Adjacent-only vector (AV:A) for 802.1X NAC context; race condition demands AC:H; low-privilege supplicant credential required (PR:L); admin restart mandatory (UI:R); impact is availability of correct access control enforcement (A:H), with no confidentiality or integrity breach.
Primary rating from Vendor (arista).
CVSS VectorVendor: arista
Lifecycle Timeline
2DescriptionCVE.org
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
AnalysisAI
Incorrect access control enforcement in Arista EOS 4.36.0 through 4.36.1F allows a stale ACL entry - produced by a race condition during 802.1X supplicant re-authentication - to persist in system state and be incorrectly applied to new supplicants after an AclAgent daemon restart. The vulnerability requires both triggering a precise race condition during re-authentication and a subsequent administrator-initiated AclAgent restart, making opportunistic exploitation highly constrained. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concurrent conditions: the target switch must run Arista EOS 4.36.0 through 4.36.1F; the device must be deployed with 802.1X supplicant authentication and AclAgent-managed ACL enforcement (non-default in environments without port-based NAC); a race condition must be successfully triggered during a supplicant re-authentication event (high attack complexity, specific timing window); and an administrator must subsequently restart the AclAgent daemon - this is a hard prerequisite per the description and is reflected as UI:A in the CVSS 4.0 vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Real-world risk is moderate and substantially lower than the access control sensitivity of ACLs might suggest. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading Arista EOS beyond the affected 4.36.0-4.36.1F range per the vendor advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-459 – Incomplete Cleanup
View allShare
External POC / Exploit Code
Leaving vuln.today