Vulnerability · Published Sep 15, 2026 · Assigned by Arista

CVE-2026-19655On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent

Medium 6.5

In plain English

A medium-severity improper input validation in EOS from Arista Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 76.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthenticated attacker connected to a client-facing VLAN(s) where the relay is configured can send a specially crafted packet that causes the DHCP Relay service to restart.

Affected products (as reported)

Vendor	Product	Versions
Arista Networks	EOS	4.35.0 – through 4.35.5M4.34.0 – through 4.34.7.1M4.33.0 – through 4.33.9M

Weakness: CWE-20 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24711-security-advisory-0155 vendor-advisory