arista-networksCVE-2026-75945

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

Low2.1CVE-2026-75945 · Published Sep 14, 2026 · updated Sep 16, 2026

Source advisory

Affected versions

Package	Affected	Fixed in
EOS Vendor	>= 4.36.0, <= 4.36.1F	No fix yet

Details and references

A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.

CVSS 4.0: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity from: no source yet
Weakness: CWE-459

More arista-networks advisories

Date	Advisory	Severity	Fixed in
Sep 14	On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network... CVE-2026-73449Medium5.9no fix yet	Medium5.9	No fix yet
Sep 14	A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. CVE-2026-75943Low2.1no fix yet	Low2.1	No fix yet
Sep 14	A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. CVE-2026-75944Medium5.6no fix yet	Medium5.6	No fix yet
Sep 14	An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the... CVE-2026-77191Low2.1no fix yet	Low2.1	No fix yet
Sep 15	On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. CVE-2026-19641Medium6.9no fix yet	Medium6.9	No fix yet
Sep 15	On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard... CVE-2026-73451Medium6.3no fix yet	Medium6.3	No fix yet

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.