CVE-2026-75945: Network Authentication Race Condition

CVE-2026-75945 Overview

CVE-2026-75945 is a race condition affecting Arista network devices that implement 802.1X port-based authentication. The flaw allows a supplicant (an authenticating client) to remain in an authorized state after an administrator issues the clear dot1x host all command. The command is intended to force reauthentication and clear session state, but under specific timing conditions the cleanup and authorization paths interleave incorrectly. This leaves stale authorization on the port, permitting continued network access without a fresh authentication decision. The issue is classified as CWE-459: Incomplete Cleanup and is documented in Arista Security Advisory #0150.

Critical Impact
An attacker adjacent to the network can retain authorized 802.1X access after administrators expect the session to be cleared, undermining port-based access control enforcement.

Affected Products

Arista EOS devices implementing 802.1X (dot1x) authentication
Refer to Arista Security Advisory #0150 for the affected release trains
Deployments using the clear dot1x host all administrative workflow

Discovery Timeline

2026-09-14 - CVE-2026-75945 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-75945

Vulnerability Analysis

The vulnerability resides in the 802.1X authentication state machine on affected Arista devices. When an operator issues clear dot1x host all, the system must transition every attached supplicant out of the authorized state and force a new authentication exchange. Because the clear operation and the concurrent supplicant state-management routines are not fully serialized, a supplicant session can survive the clear operation. The result is incomplete cleanup of authorization state, matching the CWE-459 weakness pattern.

Exploitation does not require network-based remote access. The attack vector is adjacent (Layer 2), and an actor must already possess valid low-privilege credentials or an active session on the switched segment. The confidentiality and availability impacts are none, and the integrity impact is limited, which aligns with the low severity rating.

Root Cause

The root cause is a race condition between the administrative clear routine and the 802.1X supplicant state machine. Operations that should be atomic (removing session context and setting the port back to an unauthorized state) can be interleaved with in-flight authentication events, so a supplicant record persists with its authorized flag intact.

Attack Vector

A successful outcome requires precise timing between the administrator issuing clear dot1x host all and supplicant activity on the wire. The attacker does not directly trigger the vulnerability; instead, an active supplicant benefits from the race by retaining authorization after the operator expects it to have been revoked. No verified exploit code has been published for CVE-2026-75945, and it is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available for this vulnerability.
Refer to Arista Security Advisory #0150 for authoritative technical detail.

Detection Methods for CVE-2026-75945

Indicators of Compromise

Supplicant MAC addresses that appear in show dot1x hosts output immediately after a clear dot1x host all command was executed.
Ports reporting an authorized 802.1X state without a corresponding recent authentication success event in AAA logs.
RADIUS accounting records that show session continuity across an operator-initiated clear event.

Detection Strategies

Correlate operator command history for clear dot1x events with the subsequent 802.1X session table to identify supplicants that persist through the clear operation.
Compare RADIUS Access-Accept timestamps against port authorization timestamps to surface authorized sessions with no matching recent authentication.
Alert on any host that maintains network access following an administrative clear until a new EAPOL exchange is observed.

Monitoring Recommendations

Forward EOS syslog and AAA accounting streams to a centralized analytics platform for long-term correlation.
Track the rate and outcome of 802.1X reauthentication events per port to identify anomalies.
Baseline the expected number of authorized supplicants per port and alert on deviations after administrative actions.

How to Mitigate CVE-2026-75945

Immediate Actions Required

Review Arista Security Advisory #0150 and identify affected EOS versions in the environment.
Schedule upgrades to the fixed EOS release train listed in the advisory.
After issuing clear dot1x host all, verify with show dot1x hosts that no supplicant retains authorized state.

Patch Information

Arista has published remediation guidance in Security Advisory #0150. Apply the fixed EOS image identified in that advisory for the affected release train. No hotfix hash is available in the enriched CVE data; consult the vendor advisory for the authoritative version list.

Workarounds

As an alternative to clear dot1x host all, shut and re-enable the affected interface with shutdown followed by no shutdown to force a full port reset.
Use per-interface clear dot1x interface <intf> operations and verify session removal on each port individually.
Where operationally acceptable, reduce the 802.1X reauthentication timer so stale authorizations expire more quickly.

bash

# Verify no supplicants remain authorized after issuing a clear
switch# clear dot1x host all
switch# show dot1x hosts

# Force a hard port reset as a workaround for a specific interface
switch(config)# interface Ethernet1
switch(config-if-Et1)# shutdown
switch(config-if-Et1)# no shutdown