CVE-2026-75944: CWE-459 Incomplete Cleanup in Arista Networks EOS
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
AI Analysis
Technical Summary
This vulnerability involves an incomplete cleanup (CWE-459) in Arista Networks EOS versions 4.36.0 through 4.36.1F. A race condition during supplicant re-authentication can cause a stale ACL entry to persist. If the AclAgent process is restarted by an administrator, this stale ACL entry may be applied to new supplicants, leading to incorrect access control enforcement. The CVSS 3.1 base score is 2.6, reflecting low impact with high attack complexity and low privileges required. There is no indication of a patch or fix available in the provided data.
Potential Impact
The impact is limited to incorrect access control enforcement due to stale ACL entries being applied after an AclAgent restart. There is no confidentiality, availability, or integrity loss beyond this limited incorrect enforcement. Exploitation requires user interaction (administrator restarting AclAgent). No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid restarting the AclAgent unnecessarily to prevent stale ACL entries from being applied. Monitor vendor communications for updates or patches addressing this issue.
CVE-2026-75944: CWE-459 Incomplete Cleanup in Arista Networks EOS
Description
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
CVSS v3.1
Score 2.6low
Affected software
Arista Networks
EOS
pkg:github/aristanetworks/eosRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an incomplete cleanup (CWE-459) in Arista Networks EOS versions 4.36.0 through 4.36.1F. A race condition during supplicant re-authentication can cause a stale ACL entry to persist. If the AclAgent process is restarted by an administrator, this stale ACL entry may be applied to new supplicants, leading to incorrect access control enforcement. The CVSS 3.1 base score is 2.6, reflecting low impact with high attack complexity and low privileges required. There is no indication of a patch or fix available in the provided data.
Potential Impact
The impact is limited to incorrect access control enforcement due to stale ACL entries being applied after an AclAgent restart. There is no confidentiality, availability, or integrity loss beyond this limited incorrect enforcement. Exploitation requires user interaction (administrator restarting AclAgent). No known exploits are reported in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid restarting the AclAgent unnecessarily to prevent stale ACL entries from being applied. Monitor vendor communications for updates or patches addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Arista
- Date Reserved
- 2026-08-18T16:04:11.105Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa875f055bf5e2cf5ba9995
Added to database: 09/14/2026, 22:32:16 UTC
Last enriched: 09/14/2026, 22:46:43 UTC
Last updated: 09/14/2026, 23:32:03 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.