CVE-2026-73449: Arista EOS Auth Bypass Vulnerability

CVE-2026-73449 Overview

CVE-2026-73449 affects Arista EOS platforms configured with both 802.1X port authentication and the RADIUS proxy feature with dynamic authorization enabled. A low-privileged attacker on an adjacent network segment can induce a RADIUS packet through a configured RADIUS proxy client. This action prevents RADIUS dynamic authorization messages, including Change-of-Authorization (CoA) and Disconnect-Request messages defined in RFC 5176, from applying to locally authenticated 802.1X sessions. Endpoint sessions that a RADIUS server or network access control (NAC) system has ordered disconnected remain authorized on the network. The issue was discovered internally by Arista, and the vendor is not aware of malicious exploitation in customer networks.

Critical Impact
Attackers can keep 802.1X-authenticated endpoints connected to the network after a RADIUS server issues a disconnect or authorization change, undermining NAC enforcement.

Affected Products

Arista EOS with 802.1X port authentication and dynamic authorization enabled
Arista EOS with RADIUS proxy configured with dynamic authorization
Deployments requiring both features simultaneously (see Arista Security Advisory #0149)

Discovery Timeline

2026-09-14 - CVE-2026-73449 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73449

Vulnerability Analysis

The vulnerability is classified as an authentication bypass by spoofing weakness [CWE-290]. It affects how Arista EOS correlates inbound RADIUS dynamic authorization traffic when both the 802.1X authenticator and the RADIUS proxy are active on the same device. When an attacker on an adjacent Layer 2 segment triggers a RADIUS packet through the proxy client path, the EOS dynamic authorization handler routes subsequent CoA and Disconnect-Request messages incorrectly. The result is that RFC 5176 messages targeting locally authenticated 802.1X sessions are not applied to those sessions. Sessions the NAC system considers terminated continue to hold their network authorization state.

Root Cause

The root cause lies in the session-lookup logic used when both features coexist. EOS misattributes dynamic authorization requests, treating them as belonging to the RADIUS proxy scope rather than the local 802.1X authenticator scope. This misattribution allows an adjacent attacker to influence how the device demultiplexes CoA and Disconnect traffic. Both feature paths must be explicitly configured for the flaw to be reachable.

Attack Vector

Exploitation requires network adjacency and low privileges, without user interaction. An attacker on a reachable segment induces a RADIUS packet via a configured RADIUS proxy client. Once this state is triggered, subsequent CoA and Disconnect-Request messages targeting 802.1X sessions are silently dropped from the enforcement pipeline. The vulnerability does not disclose data but degrades integrity of access control and availability of enforcement actions. Technical details are documented in the Arista Security Advisory #0149.

No verified proof-of-concept code is publicly available for this issue.

Detection Methods for CVE-2026-73449

Indicators of Compromise

802.1X sessions that remain in an authorized state after the NAC or RADIUS server has issued a Disconnect-Request
Discrepancies between RADIUS server accounting logs and EOS show dot1x session state
Unexpected inbound RADIUS packets sourced from adjacent segments hitting the RADIUS proxy client

Detection Strategies

Compare CoA and Disconnect-Request events issued by the RADIUS or NAC platform against actual session termination timestamps on EOS switches.
Alert when authenticated endpoints persist beyond expected session lifetimes or after policy-driven disconnect events.
Correlate RADIUS proxy traffic patterns with 802.1X session state changes to identify suppression of dynamic authorization actions.

Monitoring Recommendations

Enable and centrally collect RADIUS accounting from EOS devices into a SIEM for reconciliation with NAC decisions.
Monitor syslog for RADIUS proxy and dot1x subsystem messages, particularly errors related to CoA or Disconnect handling.
Track adjacent-segment traffic hitting RADIUS proxy client addresses to identify anomalous injection attempts.

How to Mitigate CVE-2026-73449

Immediate Actions Required

Review EOS running configurations to identify devices that enable both 802.1X port authentication with dynamic authorization and RADIUS proxy with dynamic authorization.
Apply the fixed EOS release identified in Arista Security Advisory #0149 on all exposed switches.
Restrict adjacent Layer 2 access to switch interfaces that could source RADIUS traffic toward proxy clients.

Patch Information

Arista has published remediation guidance in Arista Security Advisory #0149. Consult the advisory for the specific fixed EOS train and hotfix availability that matches your deployment.

Workarounds

Disable the RADIUS proxy dynamic authorization feature where operationally acceptable until the patch is deployed.
Alternatively, disable dynamic authorization on the 802.1X authenticator path if CoA and Disconnect enforcement can be handled through session timeouts.
Apply access control lists on management and RADIUS-facing interfaces to limit sources that can inject RADIUS traffic to trusted servers only.

bash

# Configuration example - inspect current exposure on Arista EOS
show running-config | include dot1x|radius
show dot1x
show aaa server radius dynamic-authorization