In order to be vulnerable to CVE-2026-77190, the following conditions must both be met:
1. PIM Sparse Mode must be configured (IPv4 or IPv6). For example:
switch(config)# interface Ethernet1\nswitch(config-if-Et1)# pim ipv4 sparse-mode\n\nswitch# show agent Pimsm uptime\n Agent Name Restarts Uptime\n------------------ -------------- ----------------\nPimsm 1 2 days, 14:00:28
or
switch(config)# interface Vlan2\nswitch(config-if-Vl2)# pim ipv6 sparse-mode\n\nswitch# show agent Pimsm6 uptime\n Agent Name Restarts Uptime\n------------------ -------------- ----------------\nPimsm6 3 2 days, 14:00:20
2. MLAG must be configured and active:
switch(config)# mlag\nswitch(config-mlag)# local-interface vlan 4094\nswitch(config-mlag)# peer-address 10.0.0.2\nswitch(config-mlag)# peer-link port-channel 10\nswitch(config-mlag)# domain-id mlag1\n\nswitch# show mlag\nMLAG Configuration:\ndomain-id : mlag1\nlocal-interface : Vlan4094\npeer-address : 10.0.0.2\npeer-link : Port-Channel10\nMLAG Status:\nstate : Active\npeer-link status : Up\nlocal-int status : Up\nsystem-id : 00:11:22:01:03:01"}],"value":"In order to be vulnerable to CVE-2026-77190, the following conditions must both be met:\n\n1. PIM Sparse Mode must be configured (IPv4 or IPv6). For example:\n\n switch(config)# interface Ethernet1\n switch(config-if-Et1)# pim ipv4 sparse-mode\n\n switch# show agent Pimsm uptime\n Agent Name Restarts Uptime\n ------------------ -------------- ----------------\n Pimsm 1 2 days, 14:00:28\n\nor\n\n switch(config)# interface Vlan2\n switch(config-if-Vl2)# pim ipv6 sparse-mode\n\n switch# show agent Pimsm6 uptime\n Agent Name Restarts Uptime\n ------------------ -------------- ----------------\n Pimsm6 3 2 days, 14:00:20\n\n2. MLAG must be configured and active:\n\n switch(config)# mlag\n switch(config-mlag)# local-interface vlan 4094\n switch(config-mlag)# peer-address 10.0.0.2\n switch(config-mlag)# peer-link port-channel 10\n switch(config-mlag)# domain-id mlag1\n\n switch# show mlag\n MLAG Configuration:\n domain-id : mlag1\n local-interface : Vlan4094\n peer-address : 10.0.0.2\n peer-link : Port-Channel10\n MLAG Status:\n state : Active\n peer-link status : Up\n local-int status : Up\n system-id : 00:11:22:01:03:01"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
"}],"value":"On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service."}],"metrics":[{"cvssV3_1":{"baseScore":6.5,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"baseScore":6,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L","version":"4.0"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-20","description":"CWE-20 Improper Input Validation","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-16T10:08:55.181Z","orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista"},"references":[{"name":"Security Advisory 0177","tags":["vendor-advisory"],"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24733-security-advisory-0177"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2026-77190 has been fixed in the following releases:
No hotfix is available for this issue.
"}],"value":"The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.\n\nCVE-2026-77190 has been fixed in the following releases:\n- 4.36.2F and later releases in the 4.36.x train\n- 4.35.6M and later releases in the 4.35.x train\n- 4.34.8M and later releases in the 4.34.x train\n\nNo hotfix is available for this issue."}],"source":{"advisory":"Security Advisory 0177","defects":["BUG 1852734"],"discovery":"INTERNAL"},"title":"Security Advisory 0177","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"There is no mitigation or workaround available.
"}],"value":"There is no mitigation or workaround available."}]}},"cveMetadata":{"assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","assignerShortName":"Arista","cveId":"CVE-2026-77190","datePublished":"2026-09-16T10:08:55.181Z","dateReserved":"2026-08-20T16:41:21.387Z","dateUpdated":"2026-09-16T13:26:25.980Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-16 10:16:53","lastModifiedDate":"2026-09-16 19:08:50","problem_types":["CWE-20","CWE-20 CWE-20 Improper Input Validation"],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6,"baseSeverity":"MEDIUM","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-16T13:26:18.181290Z","id":"CVE-2026-77190","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"77190","Ordinal":"1","Title":"Security Advisory 0177","CVE":"CVE-2026-77190","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"77190","Ordinal":"1","NoteData":"On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.","Type":"Description","Title":"Security Advisory 0177"}]}}}