"}],"value":"In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n * 802.1X (dot1x in the CLI) must be configured with pae authenticator \n\n\n * port-control must be set to auto mode \n\n\n * A static or dynamic ACL must be configured. \n\n\n * The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n \n\n\n\nBelow is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\n\n\n \n\n\n\nIn this example port control is in “auto” mode, necessary for the condition to occur.\n\n\n\nconfig)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\n\n\n \n\n\n\n Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n \n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5"}],"credits":[{"lang":"en","type":"finder","value":"Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks."}],"datePublic":"2026-09-09T22:02:00.000Z","descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:
- 802.1X (dot1x in the CLI) must be configured with pae authenticator
- port-control must be set to auto mode
- A static or dynamic ACL must be configured.
- The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule
Below is an example of one configuration. Note that “mac based authentication always” is optional The supplicant can authenticate with either EAPOL or MBA.
switch(config-if-et1)#show active\n \ninterface Ethernet5\n switchport mode trunk\n spanning-tree portfast edge\n dot1x pae authenticator\n dot1x port-control auto\n \ndot1x system-auth-control\nIn this example port control is in “auto” mode, necessary for the condition to occur.
config)#show dot1x interface ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n \nDot1X Authenticator Client\nUse a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP
switch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.
To verify the configured ACL, execute the following show command to identify the ACL applied to the interface:
switch(config)#show ip access-lists interface Ethernet5 summary \nIP Access List EMPLOYEE-ACL\n 10 permit ip 10.0.0.0/8 any\n 20 deny ip any any\n \n Total rules configured: 2\n Configured on Ingress: Ethernet5\n Active on Ingress: Ethernet5
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.\n"}],"value":"An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL."}],"impacts":[{"capecId":"CAPEC-180","descriptions":[{"lang":"en","value":"CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"ADJACENT_NETWORK","availabilityImpact":"NONE","baseScore":2.6,"baseSeverity":"LOW","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"ADJACENT","baseScore":2.1,"baseSeverity":"LOW","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-09-14T22:06:28.153Z","orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista"},"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
\nCVE-2026-77191 has been fixed in the following releases:\n* 4.35.1F and later releases in the 4.35.x train.\n* 4.34.6M and later releases in the 4.34.x train.\n* 4.33.8M and later releases in the 4.33.x train.\n"}],"value":"CVE-2026-77191 has been fixed in the following releases:\n* 4.35.1F and later releases in the 4.35.x train.\n* 4.34.6M and later releases in the 4.34.x train.\n* 4.33.8M and later releases in the 4.33.x train."}],"source":{"advisory":"150","defects":["BUG 1108416"],"discovery":"INTERNAL"},"title":"All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"
\nThere is no workaround available for CVE-2026-77191.\n"}],"value":"There is no workaround available for CVE-2026-77191."}],"x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","assignerShortName":"Arista","cveId":"CVE-2026-77191","datePublished":"2026-09-14T22:06:28.153Z","dateReserved":"2026-08-20T16:41:22.053Z","dateUpdated":"2026-09-15T13:41:05.782Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-14 23:18:36","lastModifiedDate":"2026-09-16 20:36:52","problem_types":["CWE-862","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":2.1,"baseSeverity":"LOW","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"LOW","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":2.6,"baseSeverity":"LOW","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.2,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-09-15T13:40:55.120355Z","id":"CVE-2026-77191","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"77191","Ordinal":"1","Title":"All of the CVEs covered in this advisory apply to affected platf","CVE":"CVE-2026-77191","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"77191","Ordinal":"1","NoteData":"An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.","Type":"Description","Title":"All of the CVEs covered in this advisory apply to affected platf"}]}}}