Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by Arista

CVE-2026-19641On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

Medium 5.3

In plain English

A medium-severity security flaw in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 58.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected products (as reported)

VendorProductVersions
Arista Networks EOS 4.36.0 – through 4.36.0F4.35.0 – through 4.35.5M4.34.0 – through 4.34.7.1M0.0.0 – through 4.33.8M

Weakness: CWE-116 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References