CVE-2026-19641: Arista EOS Authentication DOS Vulnerability

CVE-2026-19641 Overview

CVE-2026-19641 affects Arista Extensible Operating System (EOS) devices configured with password authentication. A specially crafted password submitted during authentication can create orphan authentication sessions on the device. Repeated exploitation exhausts the pool of available authentication resources. Legitimate users are then unable to log in to the affected device.

Arista discovered the flaw internally and reports no known malicious exploitation in customer networks. The vulnerability is tracked under [CWE-116] Improper Encoding or Escaping of Output and requires no authentication to exploit over the network.

Critical Impact
Remote unauthenticated attackers can exhaust authentication resources on Arista EOS devices, preventing legitimate administrator login and disrupting device management.

Affected Products

Arista EOS with password authentication configured (see Arista Security Advisory #0152 for affected versions)
Network platforms running vulnerable Arista EOS releases
Deployments exposing authentication interfaces to untrusted networks

Discovery Timeline

2026-09-15 - CVE-2026-19641 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-19641

Vulnerability Analysis

The flaw resides in the password authentication subsystem of Arista EOS. When a specially crafted password is submitted, the authentication process fails to properly finalize the session state. The resulting orphan session remains allocated in memory or resource tables. Each attack iteration consumes an additional authentication slot.

Once the available authentication resource pool is depleted, the device rejects new login attempts from legitimate administrators. This condition constitutes a resource exhaustion denial of service against management access. The issue is classified under [CWE-116] Improper Encoding or Escaping of Output, indicating that improper handling of the password input string prevents correct downstream processing.

The EPSS score is 0.343% as of 2026-09-16, reflecting the current probability of exploitation in the wild.

Root Cause

The underlying defect is improper encoding or escaping of the authentication input. The password field, when constructed with specific byte sequences or characters, is not sanitized before it reaches session-tracking logic. The authentication routine allocates session state but never releases it because the malformed input causes an unexpected code path. Session cleanup handlers do not reap these orphan entries.

Attack Vector

An unauthenticated remote attacker sends crafted authentication requests to any interface that accepts password login on the EOS device. This includes SSH, Telnet, or other management protocols configured for password authentication. Each request leaks one authentication session resource. Automated repetition rapidly exhausts capacity and denies login to legitimate users.

No user interaction, prior credentials, or elevated privileges are required. Exploitation does not affect confidentiality or integrity, only availability of the management plane. Refer to the Arista Security Advisory #0152 for protocol-specific details.

Detection Methods for CVE-2026-19641

Indicators of Compromise

Sudden inability of legitimate administrators to authenticate to an EOS device while network connectivity remains healthy
Elevated volume of failed or incomplete authentication attempts in AAA logs from a small set of source addresses
Authentication session counters approaching or reaching configured maximums without corresponding successful logins

Detection Strategies

Baseline normal authentication session counts on EOS devices and alert on sustained deviations
Correlate SSH and Telnet connection attempts against successful authentication events to identify orphan sessions
Deploy syslog forwarding from EOS devices to a centralized SIEM and build queries for repeated authentication failures from single sources

Monitoring Recommendations

Ingest EOS AAA and authentication logs into a centralized security data lake for continuous analysis
Monitor management-plane connection rates on network devices and alert on anomalous spikes
Track administrator lockout events and management-plane availability as first-class service metrics

How to Mitigate CVE-2026-19641

Immediate Actions Required

Review Arista Security Advisory #0152 and identify EOS devices running affected releases
Apply the fixed EOS release or hotfix provided by Arista as soon as it is available for your platform
Restrict management-plane access to trusted jump hosts and administrative networks using access control lists
Enable key-based SSH authentication where feasible to reduce reliance on password authentication

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0152. Consult the advisory for the list of fixed EOS versions and any hotfix packages applicable to your hardware platform. Apply patches during a scheduled maintenance window and validate management access after upgrade.

Workarounds

Apply management-plane access control lists that permit authentication traffic only from designated administrative subnets
Prefer SSH public key authentication over password authentication on the affected devices
Rate-limit inbound management-plane connections at upstream firewalls or in EOS control-plane policing configurations
Monitor authentication session utilization and restart affected authentication services if orphan sessions accumulate

bash

# Example EOS control-plane hardening (adapt to your environment)
# Restrict SSH management access to a trusted subnet
ip access-list MGMT-ACL
   permit tcp 10.10.0.0/24 any eq ssh
   deny tcp any any eq ssh

management ssh
   ip access-group MGMT-ACL in
   authentication mode key