Vulnerability-Lookup

GHSA-H9QV-GG29-5V6F

Vulnerability from github – Published: 2026-09-15 00:31 – Updated: 2026-09-15 00:31

Details

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.

Severity

2.6 (Low)


                  
                    CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

5.6 (Medium)


                  
                    CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-75944"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-459"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-14T23:18:35Z",
    "severity": "MODERATE"
  },
  "details": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.",
  "id": "GHSA-h9qv-gg29-5v6f",
  "modified": "2026-09-15T00:31:13Z",
  "published": "2026-09-15T00:31:13Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75944"
    },
    {
      "type": "WEB",
      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-75944 (GCVE-0-2026-75944)

Vulnerability from cvelistv5 – Published: 2026-09-14 22:19 – Updated: 2026-09-14 23:06

Title

Summary

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

5.6 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-14 23:06 UTC

CWE

CWE-459 - Incomplete Cleanup

Assigner

Arista mitre root

References

1 reference

URL	Tags
https://www.arista.com/en/support/advisories-noti…

Impacted products

1 product

Vendor	Product	Version
Arista Networks	EOS	Affected: 4.36.0 , ≤ 4.36.1F (custom)

Date Public

2026-09-09 22:13

Credits

Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75944",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-14T23:06:11.210257Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-14T23:06:13.719Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "EOS",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "4.36.1F",
              "status": "affected",
              "version": "4.36.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\u003cp\u003eIn order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\u003c/p\u003e\u003col\u003e\u003cli\u003e802.1X (dot1x in the CLI) must be configured with \u003cb\u003epae authenticator\u003c/b\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eport-control must be set to auto mode\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eA static or dynamic ACL must be configured.\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003c/li\u003e\u003cli\u003eThe RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\u003c/li\u003e\u003c/ol\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eBelow is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\u003c/p\u003e\u003cpre\u003eswitch(config-if-et1)#show active\n  \ninterface Ethernet5\n\u0026nbsp;\u0026nbsp;\u0026nbsp;switchport mode trunk\n\u0026nbsp;\u0026nbsp;\u0026nbsp;spanning-tree portfast edge\n   dot1x pae authenticator\n\u0026nbsp;\u0026nbsp;\u0026nbsp;dot1x port-control auto\n  \ndot1x system-auth-control\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eIn this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.\u003c/p\u003e\u003cpre\u003econfig)#show\u0026nbsp; dot1x\u0026nbsp; interface\u0026nbsp; ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003e\u0026nbsp; Use a preconfigured ACL with which the RADIUS server returns in the \u003cb\u003eFilter-Id\u003c/b\u003e AVP\u003c/p\u003e\u003cpre\u003eswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\u003c/pre\u003e\u003cdiv\u003e\u0026nbsp;\u003c/div\u003e\u003cp\u003eAAA server will return the ACL name through \u003cb\u003eFilter-Id\u003c/b\u003e AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\u003c/p\u003e\u003cp\u003eTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\u003c/p\u003e\u003cpre\u003eswitch(config)#show ip access-lists interface Ethernet5 summary\u0026nbsp;\nIP Access List EMPLOYEE-ACL\n\u0026nbsp;\u0026nbsp;\u0026nbsp;10 permit ip 10.0.0.0/8 any\n\u0026nbsp;\u0026nbsp;\u0026nbsp;20 deny ip any any\n  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;Total rules configured: 2\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Configured on Ingress: Ethernet5\n\u0026nbsp;\u0026nbsp;\u0026nbsp;Active on Ingress: Ethernet5\u0026nbsp;\u003c/pre\u003e\u003c/pre\u003e"
            }
          ],
          "value": "In order to be vulnerable to any of the vulnerabilities, the following condition must be met under interface configuration mode:\n\n  *  802.1X (dot1x in the CLI) must be configured with pae authenticator\u00a0\n\n\n  *  port-control must be set to auto mode\u00a0\n\n\n  *  A static or dynamic ACL must be configured.\u00a0\n\n\n  *  The RADIUS Access-Accept or Change-of-Authorization (CoA) assigns an ACL to that supplicant using RADIUS AVP (Attribute-Value pair) Filter-Id or NAS-Filter-Rule\n\u00a0\n\n\n\nBelow is an example of one configuration. Note that \u201cmac based authentication always\u201d is optional The supplicant can authenticate with either EAPOL or MBA.\n\n\n\nswitch(config-if-et1)#show active\n  \ninterface Ethernet5\n\u00a0\u00a0\u00a0switchport mode trunk\n\u00a0\u00a0\u00a0spanning-tree portfast edge\n   dot1x pae authenticator\n\u00a0\u00a0\u00a0dot1x port-control auto\n  \ndot1x system-auth-control\n\n\n\u00a0\n\n\n\nIn this example port control is in \u201cauto\u201d mode, necessary for the condition to occur.\n\n\n\nconfig)#show\u00a0 dot1x\u00a0 interface\u00a0 ethernet 5 details\nDot1X Information for Ethernet5\n--------------------------------------------\nPort control: auto\nForced phone authorization: disabled\nEAPOL: enabled\nHost mode: multi-host\nMAC-based authentication: enabled\nMAC-based authentication host mode: Unconfigured\nMAC-based authentication always: enabled\nQuiet period: 60 seconds\nTX period: 5 seconds\nMaximum reauth requests: 2\nIgnore reauth timeout: No\nAuth failure VLAN: Unconfigured\nUnauthorized access VLAN egress: No\nUnauthorized native VLAN egress: No\nEAPOL authentication failure fallback: Unconfigured\nPort ErrDisabled by CoA: no\n  \nDot1X Authenticator Client\n\n\n\u00a0\n\n\n\n\u00a0 Use a preconfigured ACL with which the RADIUS server returns in the Filter-Id AVP\n\n\n\nswitch(config)#ip access-list EMPLOYEE-ACL\nswitch(config-ip-acl-EMPLOYEE-ACL)#10 permit ip 10.0.0.0/8 any\nswitch(config-ip-acl-EMPLOYEE-ACL)#20 deny ip any any\n\n\n\u00a0\n\n\n\nAAA server will return the ACL name through Filter-Id AVP through Access-Accept or CoA messages , in the above sample , Filter-Id AVP with EMPLOYEE-ACL will be received from the server.\n\n\n\nTo verify the configured ACL, execute the following show command to identify the ACL applied to the interface:\n\n\n\nswitch(config)#show ip access-lists interface Ethernet5 summary\u00a0\nIP Access List EMPLOYEE-ACL\n\u00a0\u00a0\u00a010 permit ip 10.0.0.0/8 any\n\u00a0\u00a0\u00a020 deny ip any any\n  \n\u00a0\u00a0\u00a0Total rules configured: 2\n\u00a0\u00a0\u00a0Configured on Ingress: Ethernet5\n\u00a0\u00a0\u00a0Active on Ingress: Ethernet5"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Those issues were discovered internally by Arista, and the company is not aware of any malicious exploitation of these vulnerabilities in customer networks."
        }
      ],
      "datePublic": "2026-09-09T22:13:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003eA race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.\n\u003c/pre\u003e"
            }
          ],
          "value": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-180",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-459",
              "description": "CWE-459 Incomplete Cleanup",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T22:19:19.963Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nCVE-2026-75944 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train.\n\u003c/pre\u003e"
            }
          ],
          "value": "CVE-2026-75944 has been fixed in the following release:\n* 4.36.2F and later releases in the 4.36.x train."
        }
      ],
      "source": {
        "advisory": "Security Advisory 0150",
        "defects": [
          "BUG 1697612"
        ],
        "discovery": "INTERNAL"
      },
      "title": "A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cpre\u003e\nThere is no workaround available for CVE-2026-75944.\n\u003c/pre\u003e"
            }
          ],
          "value": "There is no workaround available for CVE-2026-75944."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-75944",
    "datePublished": "2026-09-14T22:19:19.963Z",
    "dateReserved": "2026-08-18T16:04:11.105Z",
    "dateUpdated": "2026-09-14T23:06:13.719Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-H9QV-GG29-5V6F

CVE-2026-75944 (GCVE-0-2026-75944)

Tags

Sightings

Nomenclature