CVE-2026-75944: ACL Race Condition Vulnerability

CVE-2026-75944 Overview

CVE-2026-75944 is a race condition vulnerability affecting the Arista AclAgent component responsible for enforcing Access Control Lists (ACLs) during 802.1X supplicant re-authentication. When the race triggers, a stale ACL entry remains resident in system state. If an administrator subsequently restarts the AclAgent, the residual entry can be applied to new supplicants, producing incorrect access control decisions. The flaw is categorized under [CWE-459] (Incomplete Cleanup) and requires adjacent network access plus administrator interaction to reach the unsafe state.

Critical Impact
A stale ACL entry can be reapplied to unrelated supplicants after an AclAgent restart, weakening or altering network access enforcement on affected switches.

Affected Products

Arista networking products running affected EOS releases (refer to vendor advisory for exact versions)
Deployments using 802.1X supplicant authentication with dynamic ACL assignment
Systems where the AclAgent process handles ACL programming

Discovery Timeline

2026-09-14 - CVE-2026-75944 published to the National Vulnerability Database
2026-09-16 - Entry last modified in NVD

Technical Details for CVE-2026-75944

Vulnerability Analysis

The vulnerability is a race condition [CWE-459] in the ACL lifecycle handling during 802.1X supplicant re-authentication. Under normal operation, when a supplicant re-authenticates, the AclAgent removes the previous ACL binding and installs the new one. The race window occurs during this transition, allowing an ACL entry that should have been cleaned up to remain in internal state.

The stale entry does not immediately affect traffic. It becomes consequential only when the AclAgent restarts and rehydrates its runtime state from the persisted or cached configuration. During reinitialization, the leftover ACL entry can be reassociated with a different supplicant session, producing an incorrect enforcement policy.

Because the attack path requires an adjacent-network position, valid low-privilege access as a supplicant, and administrator action to restart the agent, the flaw is scored as medium severity.

Root Cause

The root cause is incomplete cleanup of ACL state during supplicant re-authentication. The re-authentication workflow does not fully synchronize the removal of the prior ACL entry with the installation of the new one. This leaves an orphaned entry that is not linked to any active session but persists in the agent's state store.

Attack Vector

An attacker on the adjacent network operating as an authenticating supplicant can influence the timing of re-authentication events to trigger the race. The stale entry then waits dormant until an operator restarts the AclAgent, at which point new supplicants may inherit the incorrect ACL. No exploit code is publicly available, and the vulnerability is not listed in CISA KEV.

No verified proof-of-concept code exists for this issue. See the Arista Security Advisory #0150 for the vendor's technical description.

Detection Methods for CVE-2026-75944

Indicators of Compromise

Supplicants receiving ACLs that do not match their assigned authentication profile after an AclAgent restart
Unexpected traffic flows from ports that should be constrained by 802.1X-assigned ACLs
ACL entries present in agent state without a corresponding active supplicant session

Detection Strategies

Audit programmed ACL entries against the current list of authenticated supplicants and flag orphaned entries
Correlate AclAgent restart events with subsequent supplicant authorization changes
Baseline expected per-port ACL assignments and alert on deviations following re-authentication events

Monitoring Recommendations

Forward switch syslog and 802.1X authentication events to a centralized SIEM for correlation
Monitor process lifecycle events for AclAgent restarts and record the operator initiating them
Track NetFlow or sFlow data for policy violations on 802.1X-controlled ports

How to Mitigate CVE-2026-75944

Immediate Actions Required

Review the Arista Security Advisory #0150 to confirm exposure of your running EOS version
Apply the vendor-supplied fixed release as soon as it is validated in your change window
Restrict administrative privileges required to restart the AclAgent and log all such actions

Patch Information

Arista has published Security Advisory #0150 with fixed release information and remediation guidance. Consult the advisory for the specific EOS versions containing the corrective code and any hotfix scripts provided by the vendor.

Workarounds

Avoid restarting the AclAgent on production switches unless required for maintenance
After any AclAgent restart, force re-authentication of affected supplicants and verify their assigned ACLs
Where feasible, reduce reliance on dynamic ACL assignment during re-authentication by using static per-port policies as a fallback

bash

# Verify ACL bindings match authenticated supplicants (illustrative)
show dot1x all
show ip access-lists dynamic
show logging | include AclAgent