{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-75943","assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","state":"PUBLISHED","assignerShortName":"Arista","dateReserved":"2026-08-18T16:04:10.264Z","datePublished":"2026-09-14T22:11:53.107Z","dateUpdated":"2026-09-15T13:48:21.268Z"},"containers":{"cna":{"providerMetadata":{"orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista","dateUpdated":"2026-09-14T22:11:53.107Z"},"title":"A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcem","problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-459","description":"CWE-459 Incomplete Cleanup","type":"CWE"}]}],"impacts":[{"capecId":"CAPEC-131","descriptions":[{"lang":"en","value":"CAPEC-131 Resource Leak Exposure"}]}],"affected":[{"vendor":"Arista Networks","product":"EOS","versions":[{"status":"affected","version":"4.36.0","lessThanOrEqual":"4.36.1F","versionType":"custom"},{"status":"affected","version":"4.35.0","lessThanOrEqual":"4.35.5M","versionType":"custom"},{"status":"affected","version":"4.34.0","lessThanOrEqual":"4.34.7.1M","versionType":"custom"},{"status":"affected","version":"0.0.0","lessThanOrEqual":"4.33.9M","versionType":"custom"}],"defaultStatus":"unaffected"}],"descriptions":[{"lang":"en","value":"A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.","supportingMedia":[{"type":"text/html","base64":false,"value":"<pre>A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.\n</pre>"}]}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"}],"configurations":[{"lang":"en","value":"In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n  *  802.1X (dot1x in the CLI) must be configured with pae authenticator \n\n\n  *  port-control must be set to auto mode \n\n\n  *  A static or dynamic ACL must be configured. \n\n\n  *  The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n \n\n\n\nBelow is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n  \ninterface Ethernet5\n   switchport mode trunk\n   spanning-tree portfast edge\n   dot1x pae authenticator\n   dot1x port-control auto\n  \ndot1x system-auth-control\n\n\n \n\n\n\nIn this example port control is in “auto” mode, necessary for the condition to occur.\n\n\n\nconfig)#show  dot1x  interface  ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n\n\n \n\n\n\n  Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n \n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n   10 permit ip 10.0.0.0/8 any\n   20 deny ip any any\n  \n   Total rules configured: 2\n   Configured on Ingress: Ethernet5\n   Active on Ingress: Ethernet5 \n\n\n\nIn addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:\n\n\n\nswitch(config-dot1x)#clear dot1x host all","supportingMedia":[{"type":"text/html","base64":false,"value":"<pre><p>In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:</p><ol><li>802.1X (dot1x in the CLI) must be configured with <b>pae authenticator</b><div>&nbsp;</div></li><li>port-control must be set to auto mode<div>&nbsp;</div></li><li>A static or dynamic ACL must be configured.<div>&nbsp;</div></li><li>The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule</li></ol><div>&nbsp;</div><p>Below is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.</p><pre>switch(config-if-et1)#show active\n  \ninterface Ethernet5\n&nbsp;&nbsp;&nbsp;switchport mode trunk\n&nbsp;&nbsp;&nbsp;spanning-tree portfast edge\n   dot1x pae authenticator\n&nbsp;&nbsp;&nbsp;dot1x port-control auto\n  \ndot1x system-auth-control\n</pre><div>&nbsp;</div><p>In this example port control is in “auto” mode, necessary for the condition to occur.</p><pre>config)#show&nbsp; dot1x&nbsp; interface&nbsp; ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n</pre><div>&nbsp;</div><p>&nbsp; Use a preconfigured ACL with which the RADIUS server returns in the <b>Filter-Id</b> AVP</p><pre>switch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n</pre><div>&nbsp;</div><p>AAA server will return the ACL name through <b>Filter-Id</b> AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.</p><p>To verify the configured ACL, execute the following show command to identify the ACL applied to the interface:</p><pre>switch(config)#show ip access-lists interface Ethernet5 summary&nbsp;\nIP Access List EMPLOYEE-ACL\n&nbsp;&nbsp;&nbsp;10 permit ip 10.0.0.0/8 any\n&nbsp;&nbsp;&nbsp;20 deny ip any any\n  \n&nbsp;&nbsp;&nbsp;Total rules configured: 2\n&nbsp;&nbsp;&nbsp;Configured on Ingress: Ethernet5\n&nbsp;&nbsp;&nbsp;Active on Ingress: Ethernet5&nbsp;</pre><p>In addition to the prerequisite above to configure 802.1X in authenticator mode with ACL-based authorization, the supplicant(s) must be removed via the below command:</p><pre>switch(config-dot1x)#clear dot1x host all</pre></pre>"}]}],"workarounds":[{"lang":"en","value":"There is no workaround available for CVE-2026-75943.","supportingMedia":[{"type":"text/html","base64":false,"value":"<pre>\nThere is no workaround available for CVE-2026-75943.\n</pre>"}]}],"solutions":[{"lang":"en","value":"CVE-2026-75943 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.","supportingMedia":[{"type":"text/html","base64":false,"value":"<pre>\nCVE-2026-75943 has been fixed in the following releases:\n* 4.36.2F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.10M and later releases in the 4.33.x train.\n</pre>"}]}],"credits":[{"lang":"en","value":"Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.","type":"finder"}],"source":{"advisory":"Security Advisory 0150","discovery":"INTERNAL","defects":["BUG 1302705"]},"x_generator":{"engine":"Vulnogram 1.0.5"},"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseSeverity":"LOW","baseScore":2.6,"vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"}},{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV4_0":{"attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","subConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","subIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED","version":"4.0","baseSeverity":"LOW","baseScore":2.1,"vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}]},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-09-15T13:48:12.132411Z","id":"CVE-2026-75943","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-15T13:48:21.268Z"}}]}}