CVE-2026-75943: 802.1X Authentication Bypass Vulnerability

CVE-2026-75943 Overview

CVE-2026-75943 is a low-severity flaw affecting Arista's 802.1X (dot1x) authentication implementation. A brief traffic leak occurs when an authenticated supplicant is removed from the switch. The window lasts milliseconds to seconds, during which the supplicant's traffic may pass without Access Control List (ACL) enforcement. Removal can happen through the clear dot1x host all Command Line Interface (CLI) command or through a supplicant timeout event. The weakness is categorized under [CWE-459] Incomplete Cleanup and requires adjacent-network access with low privileges to observe or exploit. Arista published details in Security Advisory #0150.

Critical Impact
Traffic from a removed 802.1X supplicant may transit the port without ACL enforcement for a short window, potentially exposing downstream network segments to unauthorized traffic.

Affected Products

Arista networking products implementing 802.1X (dot1x) supplicant handling as described in Arista Security Advisory #0150
Deployments using clear dot1x host all CLI operations for supplicant management
Environments relying on dot1x-applied ACLs for post-authentication traffic filtering

Discovery Timeline

2026-09-14 - CVE-2026-75943 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-75943

Vulnerability Analysis

The issue is an incomplete cleanup condition in the dot1x supplicant removal path. When an authenticated supplicant is torn down, the switch removes session state but does not atomically remove or block the ACL-enforced data path. Traffic already in flight or transmitted within the transition window continues to be forwarded without the ACL policy that governed the authenticated session.

The leak persists only for milliseconds to seconds, bounded by the time required to reprogram forwarding and filter state. An attacker on an adjacent network segment with low privileges may repeatedly trigger the condition to opportunistically transmit unfiltered frames. The confidentiality and availability impact is none, and integrity impact is limited, reflected by the CVSS 4.0 base score of 2.1.

Root Cause

The root cause is [CWE-459] Incomplete Cleanup. The removal workflow for a dot1x host does not synchronize hardware ACL state with session teardown. The forwarding path briefly operates without the policy previously bound to the supplicant, allowing packets to traverse the port without filtering.

Attack Vector

Exploitation requires adjacent-network position and existing low-privilege access to trigger or coincide with a supplicant removal event. Removal can be induced administratively via clear dot1x host all or naturally through supplicant timeout. During the brief unenforced window, the attacker can push traffic that would otherwise be dropped by the applied ACL. No user interaction is required, but attack complexity is low and the exploitable window is short. The Arista Security Advisory #0150 provides the authoritative technical description of the affected code path.

Refer to the Arista Security Advisory #0150 for a complete technical breakdown of the affected component.

Detection Methods for CVE-2026-75943

Indicators of Compromise

Unexpected traffic from a MAC address immediately after a dot1x session teardown or timeout event in switch logs
Log entries from clear dot1x host all operations correlated with traffic bursts on the same port
ACL counter anomalies showing traffic that would have matched deny rules on the affected interface

Detection Strategies

Correlate dot1x authentication state changes with NetFlow, sFlow, or IPFIX records to identify frames forwarded during teardown windows
Enable and centrally aggregate dot1x, AAA, and ACL logging from Arista devices for time-series analysis
Alert on repeated clear dot1x host all invocations, which may indicate deliberate triggering of the leak window

Monitoring Recommendations

Ship switch syslog and dot1x event data to a centralized data lake for correlation across sessions and interfaces
Monitor per-interface ACL hit and drop counters for irregular patterns after supplicant teardown
Baseline expected supplicant timeout frequency and alert on deviations that could indicate abuse

How to Mitigate CVE-2026-75943

Immediate Actions Required

Review Arista Security Advisory #0150 to confirm exposure across deployed Extensible Operating System (EOS) versions and platforms
Apply the fixed release or hotfix identified by Arista for the affected platforms
Limit administrative use of clear dot1x host all to change windows and log all invocations

Patch Information

Refer to the Arista Security Advisory #0150 for the authoritative list of fixed versions, hotfix availability, and platform applicability. No patch metadata beyond the vendor advisory is present in the NVD record for CVE-2026-75943.

Workarounds

Apply defense-in-depth segmentation so that a short unenforced window on a dot1x port does not expose sensitive network segments
Reduce reliance on clear dot1x host all in favor of per-host clearing operations to narrow the blast radius
Tune supplicant timeout values to reduce the frequency of teardown events where operationally acceptable

bash

# Configuration example
# Refer to Arista Security Advisory #0150 for authoritative remediation guidance:
# https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150