CVE-2026-19641 (GCVE-0-2026-19641)
Vulnerability from cvelistv5 – Published: 2026-09-15 18:17 – Updated: 2026-09-15 19:25
VLAI
EPSS
VEX
Title
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit
Summary
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-15 19:24 UTC
CWE
- CWE-116 - Improper Encoding or Escaping
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Arista Networks | EOS |
Affected:
4.36.0 , ≤ 4.36.0F
(custom)
Affected: 4.35.0 , ≤ 4.35.5M (custom) Affected: 4.34.0 , ≤ 4.34.7.1M (custom) Affected: 0.0.0 , ≤ 4.33.8M (custom) |
guessed |
Date Public
2026-09-09 18:15
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:24:56.712841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:25:06.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to CVE-2026-19641, both of the following conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eLogin authentication must be enabled, which is the default configuration.\u003cbr\u003eThe following command can be used to verify the login authentication methods.\u003cbr\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cpre\u003eswitch\u0026gt;show aaa methods authentication\u0026nbsp;\nAuthentication method lists for LOGIN:\n\u0026nbsp;\u0026nbsp;name=default methods=local\nAuthentication method list for ENABLE:\n\u0026nbsp;\u0026nbsp;name=default methods=local\nAuthentication method list for DOT1X:\n\u0026nbsp;\u0026nbsp;name=default methods=\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIf the \u201cmethods\u201d under \u201cAuthentication method lists for LOGIN\u201d does not show \u201cnone\u201d, that means login authentication is enabled.\u003c/p\u003e\u003c/li\u003e\u003cli\u003eA service that accepts password-based authentication is enabled (e.g., SSH with password authentication, or telnet). By default, SSH with password authentication is enabled and telnet is disabled.\u003cbr\u003eFor SSH, use the following command to check whether it is enabled for any VRF.\u003cbr\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cpre\u003eswitch\u0026gt;show management ssh\nUser certificate authentication methods: none (neither trusted CA nor SSL profile configured)\nSSHD status for Default VRF: enabled\nSSH connection limit: 50\nSSH per host connection limit: 20\nFIPS status: disabled\neAPI subsystem: enabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eUse the following command to check if password-based authentication is enabled for SSH. SSH is vulnerable if \u201cpassword\u201d or \u201ckeyboard-interactive\u201d is listed.\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show run all section management ssh | grep protocol\n\u0026nbsp;\u0026nbsp;\u0026nbsp;authentication protocol keyboard-interactive public-key\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eFor Telnet, use the following command to check whether it is enabled for any VRF. Telnet is vulnerable if enabled.\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show management telnet\nTelnet status for Default VRF is enabled\u0026nbsp;\nTelnet session limit is 20\nTelnet session limit per host is 20\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe device is vulnerable if login authentication is enabled and SSH with password-based method or Telnet is enabled.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-19641, both of the following conditions must be met:\n\n * Login authentication must be enabled, which is the default configuration.\nThe following command can be used to verify the login authentication methods.\n\u00a0\n\n\n\nswitch\u003eshow aaa methods authentication\u00a0\nAuthentication method lists for LOGIN:\n\u00a0\u00a0name=default methods=local\nAuthentication method list for ENABLE:\n\u00a0\u00a0name=default methods=local\nAuthentication method list for DOT1X:\n\u00a0\u00a0name=default methods=\n\n\n\u00a0\n\n\n\nIf the \u201cmethods\u201d under \u201cAuthentication method lists for LOGIN\u201d does not show \u201cnone\u201d, that means login authentication is enabled.\n\n\n * A service that accepts password-based authentication is enabled (e.g., SSH with password authentication, or telnet). By default, SSH with password authentication is enabled and telnet is disabled.\nFor SSH, use the following command to check whether it is enabled for any VRF.\n\u00a0\n\n\n\nswitch\u003eshow management ssh\nUser certificate authentication methods: none (neither trusted CA nor SSL profile configured)\nSSHD status for Default VRF: enabled\nSSH connection limit: 50\nSSH per host connection limit: 20\nFIPS status: disabled\neAPI subsystem: enabled\n\n\n\u00a0\n\n\n\nUse the following command to check if password-based authentication is enabled for SSH. SSH is vulnerable if \u201cpassword\u201d or \u201ckeyboard-interactive\u201d is listed.\n\n\n\nswitch\u003eshow run all section management ssh | grep protocol\n\u00a0\u00a0\u00a0authentication protocol keyboard-interactive public-key\n\n\n\u00a0\n\n\n\nFor Telnet, use the following command to check whether it is enabled for any VRF. Telnet is vulnerable if enabled.\n\n\n\nswitch\u003eshow management telnet\nTelnet status for Default VRF is enabled\u00a0\nTelnet session limit is 20\nTelnet session limit per host is 20\n\n\n\u00a0\n\n\n\nThe device is vulnerable if login authentication is enabled and SSH with password-based method or Telnet is enabled."
}
],
"datePublic": "2026-09-09T18:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eOn affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\n\u003c/pre\u003e"
}
],
"value": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:17:55.548Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\nThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades.\n\nCVE-2026-19641 has been fixed in the following releases:\n* 4.36.1F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.9M and later releases in the 4.33.x train.\n\u003c/pre\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades.\n\nCVE-2026-19641 has been fixed in the following releases:\n* 4.36.1F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.9M and later releases in the 4.33.x train."
}
],
"source": {
"advisory": "Security Advisory 0152",
"defects": [
"BUG 1595868",
"BUG 1966286 (DMF)"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eThe workaround is to disable password based authentication services, such as Telnet and SSH.\u003c/p\u003e\u003cp\u003eNOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).\u003c/p\u003e\u003cp\u003eUse the following command to disable Telnet.\u003c/p\u003e\u003cpre\u003eswitch(config)#management telnet\nswitch(config-mgmt-telnet)#shutdown\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eOn the client host, use the following command to generate SSH keys.\u003c/p\u003e\u003cpre\u003eclient# ssh-keygen -t ecdsa -b 521 -f testkey\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eCopy the SSH public key to the device and add it to the local user.\u003c/p\u003e\u003cpre\u003eswitch(config)#copy scp:\u0026lt;local_path_with_keys\u0026gt;/testkey.pub flash:\nswitch(config)#username \u0026lt;user\u0026gt; sshkey file flash:testkey.pub\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAdd public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.\u003c/p\u003e\u003cpre\u003eswitch(config)#management ssh\nswitch(config)#authentication protocol public-key keyboard-interactive\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eOnce you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.\u003c/p\u003e\u003cpre\u003eswitch(config)#management ssh\nswitch(config)#authentication protocol public-key\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.\u003cbr\u003e\u003cbr\u003eInstead of public key, certificate-based authentication can also be used as a workaround for local users.\u003c/p\u003e\u003cp\u003ePlease find more details about how to configure certificate-based authentication in the \u003ca href=\"https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eSSH Certificates User Guide\u003c/a\u003e.\u003c/p\u003e\u003c/pre\u003e"
}
],
"value": "The workaround is to disable password based authentication services, such as Telnet and SSH.\n\n\n\nNOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).\n\n\n\nUse the following command to disable Telnet.\n\n\n\nswitch(config)#management telnet\nswitch(config-mgmt-telnet)#shutdown\n\n\n\u00a0\n\n\n\nOn the client host, use the following command to generate SSH keys.\n\n\n\nclient# ssh-keygen -t ecdsa -b 521 -f testkey\n\n\n\u00a0\n\n\n\nCopy the SSH public key to the device and add it to the local user.\n\n\n\nswitch(config)#copy scp:\u003clocal_path_with_keys\u003e/testkey.pub flash:\nswitch(config)#username \u003cuser\u003e sshkey file flash:testkey.pub\n\n\n\u00a0\n\n\n\nAdd public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.\n\n\n\nswitch(config)#management ssh\nswitch(config)#authentication protocol public-key keyboard-interactive\n\n\n\u00a0\n\n\n\nOnce you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.\n\n\n\nswitch(config)#management ssh\nswitch(config)#authentication protocol public-key\n\n\n\u00a0\n\n\n\nWARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.\n\nInstead of public key, certificate-based authentication can also be used as a workaround for local users.\n\n\n\nPlease find more details about how to configure certificate-based authentication in the SSH Certificates User Guide https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates ."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-19641",
"datePublished": "2026-09-15T18:17:55.548Z",
"dateReserved": "2026-08-12T16:48:22.864Z",
"dateUpdated": "2026-09-15T19:25:06.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-19641",
"date": "2026-09-24",
"epss": "0.00343",
"percentile": "0.24988"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"source": "psirt@arista.com"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"id": "CVE-2026-19641",
"lastModified": "2026-09-16T19:08:50.420",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 1.4,
"source": "psirt@arista.com",
"type": "Secondary"
}
],
"cvssMetricV40": [
{
"cvssData": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"availabilityRequirement": "NOT_DEFINED",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"confidentialityRequirement": "NOT_DEFINED",
"exploitMaturity": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"source": "psirt@arista.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-19641",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:24:56.712841Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-15T19:17:17.387",
"references": [
{
"source": "psirt@arista.com",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152"
}
],
"sourceIdentifier": "psirt@arista.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-116"
}
],
"source": "psirt@arista.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19641",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-15T19:24:56.712841Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T19:25:00.835Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EOS",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "4.36.0F",
"status": "affected",
"version": "4.36.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.35.5M",
"status": "affected",
"version": "4.35.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.34.7.1M",
"status": "affected",
"version": "4.34.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "4.33.8M",
"status": "affected",
"version": "0.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to CVE-2026-19641, both of the following conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eLogin authentication must be enabled, which is the default configuration.\u003cbr\u003eThe following command can be used to verify the login authentication methods.\u003cbr\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cpre\u003eswitch\u0026gt;show aaa methods authentication\u0026nbsp;\nAuthentication method lists for LOGIN:\n\u0026nbsp;\u0026nbsp;name=default methods=local\nAuthentication method list for ENABLE:\n\u0026nbsp;\u0026nbsp;name=default methods=local\nAuthentication method list for DOT1X:\n\u0026nbsp;\u0026nbsp;name=default methods=\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIf the \u201cmethods\u201d under \u201cAuthentication method lists for LOGIN\u201d does not show \u201cnone\u201d, that means login authentication is enabled.\u003c/p\u003e\u003c/li\u003e\u003cli\u003eA service that accepts password-based authentication is enabled (e.g., SSH with password authentication, or telnet). By default, SSH with password authentication is enabled and telnet is disabled.\u003cbr\u003eFor SSH, use the following command to check whether it is enabled for any VRF.\u003cbr\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cpre\u003eswitch\u0026gt;show management ssh\nUser certificate authentication methods: none (neither trusted CA nor SSL profile configured)\nSSHD status for Default VRF: enabled\nSSH connection limit: 50\nSSH per host connection limit: 20\nFIPS status: disabled\neAPI subsystem: enabled\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eUse the following command to check if password-based authentication is enabled for SSH. SSH is vulnerable if \u201cpassword\u201d or \u201ckeyboard-interactive\u201d is listed.\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show run all section management ssh | grep protocol\n\u0026nbsp;\u0026nbsp;\u0026nbsp;authentication protocol keyboard-interactive public-key\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eFor Telnet, use the following command to check whether it is enabled for any VRF. Telnet is vulnerable if enabled.\u003c/p\u003e\u003cpre\u003eswitch\u0026gt;show management telnet\nTelnet status for Default VRF is enabled\u0026nbsp;\nTelnet session limit is 20\nTelnet session limit per host is 20\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eThe device is vulnerable if login authentication is enabled and SSH with password-based method or Telnet is enabled.\u003c/p\u003e\u003c/li\u003e\u003c/ol\u003e\u003c/pre\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-19641, both of the following conditions must be met:\n\n * Login authentication must be enabled, which is the default configuration.\nThe following command can be used to verify the login authentication methods.\n\u00a0\n\n\n\nswitch\u003eshow aaa methods authentication\u00a0\nAuthentication method lists for LOGIN:\n\u00a0\u00a0name=default methods=local\nAuthentication method list for ENABLE:\n\u00a0\u00a0name=default methods=local\nAuthentication method list for DOT1X:\n\u00a0\u00a0name=default methods=\n\n\n\u00a0\n\n\n\nIf the \u201cmethods\u201d under \u201cAuthentication method lists for LOGIN\u201d does not show \u201cnone\u201d, that means login authentication is enabled.\n\n\n * A service that accepts password-based authentication is enabled (e.g., SSH with password authentication, or telnet). By default, SSH with password authentication is enabled and telnet is disabled.\nFor SSH, use the following command to check whether it is enabled for any VRF.\n\u00a0\n\n\n\nswitch\u003eshow management ssh\nUser certificate authentication methods: none (neither trusted CA nor SSL profile configured)\nSSHD status for Default VRF: enabled\nSSH connection limit: 50\nSSH per host connection limit: 20\nFIPS status: disabled\neAPI subsystem: enabled\n\n\n\u00a0\n\n\n\nUse the following command to check if password-based authentication is enabled for SSH. SSH is vulnerable if \u201cpassword\u201d or \u201ckeyboard-interactive\u201d is listed.\n\n\n\nswitch\u003eshow run all section management ssh | grep protocol\n\u00a0\u00a0\u00a0authentication protocol keyboard-interactive public-key\n\n\n\u00a0\n\n\n\nFor Telnet, use the following command to check whether it is enabled for any VRF. Telnet is vulnerable if enabled.\n\n\n\nswitch\u003eshow management telnet\nTelnet status for Default VRF is enabled\u00a0\nTelnet session limit is 20\nTelnet session limit per host is 20\n\n\n\u00a0\n\n\n\nThe device is vulnerable if login authentication is enabled and SSH with password-based method or Telnet is enabled."
}
],
"datePublic": "2026-09-09T18:15:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eOn affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.\n\u003c/pre\u003e"
}
],
"value": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.\n\nThis issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks."
}
],
"impacts": [
{
"capecId": "CAPEC-130",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-130 Excessive Allocation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-15T18:17:55.548Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\nThe recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades.\n\nCVE-2026-19641 has been fixed in the following releases:\n* 4.36.1F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.9M and later releases in the 4.33.x train.\n\u003c/pre\u003e"
}
],
"value": "The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades.\n\nCVE-2026-19641 has been fixed in the following releases:\n* 4.36.1F and later releases in the 4.36.x train.\n* 4.35.6M and later releases in the 4.35.x train.\n* 4.34.8M and later releases in the 4.34.x train.\n* 4.33.9M and later releases in the 4.33.x train."
}
],
"source": {
"advisory": "Security Advisory 0152",
"defects": [
"BUG 1595868",
"BUG 1966286 (DMF)"
],
"discovery": "INTERNAL"
},
"title": "On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003e\u003cp\u003eThe workaround is to disable password based authentication services, such as Telnet and SSH.\u003c/p\u003e\u003cp\u003eNOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).\u003c/p\u003e\u003cp\u003eUse the following command to disable Telnet.\u003c/p\u003e\u003cpre\u003eswitch(config)#management telnet\nswitch(config-mgmt-telnet)#shutdown\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eOn the client host, use the following command to generate SSH keys.\u003c/p\u003e\u003cpre\u003eclient# ssh-keygen -t ecdsa -b 521 -f testkey\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eCopy the SSH public key to the device and add it to the local user.\u003c/p\u003e\u003cpre\u003eswitch(config)#copy scp:\u0026lt;local_path_with_keys\u0026gt;/testkey.pub flash:\nswitch(config)#username \u0026lt;user\u0026gt; sshkey file flash:testkey.pub\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAdd public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.\u003c/p\u003e\u003cpre\u003eswitch(config)#management ssh\nswitch(config)#authentication protocol public-key keyboard-interactive\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eOnce you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.\u003c/p\u003e\u003cpre\u003eswitch(config)#management ssh\nswitch(config)#authentication protocol public-key\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eWARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.\u003cbr\u003e\u003cbr\u003eInstead of public key, certificate-based authentication can also be used as a workaround for local users.\u003c/p\u003e\u003cp\u003ePlease find more details about how to configure certificate-based authentication in the \u003ca href=\"https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates\" target=\"_blank\" rel=\"noopener noreferrer\"\u003eSSH Certificates User Guide\u003c/a\u003e.\u003c/p\u003e\u003c/pre\u003e"
}
],
"value": "The workaround is to disable password based authentication services, such as Telnet and SSH.\n\n\n\nNOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP).\n\n\n\nUse the following command to disable Telnet.\n\n\n\nswitch(config)#management telnet\nswitch(config-mgmt-telnet)#shutdown\n\n\n\u00a0\n\n\n\nOn the client host, use the following command to generate SSH keys.\n\n\n\nclient# ssh-keygen -t ecdsa -b 521 -f testkey\n\n\n\u00a0\n\n\n\nCopy the SSH public key to the device and add it to the local user.\n\n\n\nswitch(config)#copy scp:\u003clocal_path_with_keys\u003e/testkey.pub flash:\nswitch(config)#username \u003cuser\u003e sshkey file flash:testkey.pub\n\n\n\u00a0\n\n\n\nAdd public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now.\n\n\n\nswitch(config)#management ssh\nswitch(config)#authentication protocol public-key keyboard-interactive\n\n\n\u00a0\n\n\n\nOnce you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration.\n\n\n\nswitch(config)#management ssh\nswitch(config)#authentication protocol public-key\n\n\n\u00a0\n\n\n\nWARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration.\n\nInstead of public key, certificate-based authentication can also be used as a workaround for local users.\n\n\n\nPlease find more details about how to configure certificate-based authentication in the SSH Certificates User Guide https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates ."
}
],
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-19641",
"datePublished": "2026-09-15T18:17:55.548Z",
"dateReserved": "2026-08-12T16:48:22.864Z",
"dateUpdated": "2026-09-15T19:25:06.761Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…