Arista EOS CVE-2026-75945

Exploitation requires: (1) the target device runs Arista EOS 4.36.0-4.36.1F with IEEE 802.1X authentication (dot1x) actively configured and enforced on at least one port; (2) an administrator issues the 'clear dot1x host all' command, creating the cleanup window the race condition exploits; (3) a supplicant is present and authenticated at the time the command executes, and timing aligns with the race window. The attack vector is adjacent (Layer 2 / same broadcast domain), limiting exposure to devices already on the local network segment. Limiting factors: not remotely triggerable without pre-existing adjacency; requires specific EOS release train (4.36.0-4.36.1F); race condition is not reliably automatable (SSVC Automatable: no); the 'attacker' is a device that is passively benefiting from incomplete cleanup rather than actively triggering the vulnerability.

Real-world risk is low. The CVSS 4.0 score of 2.1 reflects the constrained impact accurately: AV:A (adjacent network, not remotely exploitable over the internet), AT:P (attack requires a specific timing condition), PR:L (some level of privilege), VI:L (low integrity impact only), and no confidentiality or availability impact. SSVC corroborates this with Exploitation: none, Automatable: no, and Technical Impact: partial. EPSS data is not available in the input. There is no KEV listing and no POC code. The practical risk is that a network admin believes a device has been deauthorized but it has not - the window is timing-dependent and not reliably triggerable on demand. This is a correctness/integrity gap in administrative control rather than a remotely exploitable attack surface. Defenders should prioritize this only in environments where 802.1X is actively used as a NAC enforcement boundary and where the 'clear dot1x host all' command is part of incident response or device rotation procedures.

A network administrator issues 'clear dot1x host all' during an incident response procedure to revoke access for a compromised or untrusted endpoint. Due to the race condition, that endpoint's 802.1X authorization state is not fully cleared, and it continues to pass traffic on the network segment. The attacker on the retained supplicant exploits the continued access window to maintain lateral movement or exfiltrate data before the oversight is noticed.