All of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplicant policy enforcement. An authenticated supplicant on an

Why this deserves its current priority

A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Arista Networks/EOS (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Arista Networks/EOS.
2. 2Review the reported fix. Monitor this advisory for an available fix and review any installs of the affected package.

Evidence timeline and material changes

1. Published upstream

   Sep 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 14, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 14, 2026

Sources and claim methodology

• Source referencearista.com

Related CVEs

• On affected platforms running Arista EOS with both 802.1X port authentication and the RADIUS proxy feature configured with dynamic authorization, a low-privileged attacker on an adjacent network segment who induces a RADIUS packet through a configured RADISame arista networks/eos package
• A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcemSame arista networks/eos package
• A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. UserSame arista networks/eos package
• A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.Same arista networks/eos package
• Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.Also CWE-862
• Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026Same generic ecosystem