CVE-2026-77190: Arista EOS PIM Sparse Mode DOS Vulnerability

CVE-2026-77190 Overview

CVE-2026-77190 affects Arista Networks EOS platforms configured with Protocol Independent Multicast Sparse Mode (PIM-SM) and Multi-Chassis Link Aggregation (MLAG). An unauthenticated attacker on an adjacent network can send malformed PIM messages to the switch. These messages cause the Pimsm agent to terminate unexpectedly. While EOS automatically restarts the agent, repeated attacks trigger continuous restarts and produce a sustained denial of service against multicast routing. The flaw is tracked under CWE-20: Improper Input Validation and is documented in Arista Security Advisory #0177.

Critical Impact
Attackers with adjacent network access can disable multicast routing on Arista EOS switches by repeatedly crashing the Pimsm agent.

Affected Products

Arista EOS platforms with PIM Sparse Mode enabled
Arista EOS platforms with MLAG configured
Refer to Arista Security Advisory #0177 for the specific EOS version matrix

Discovery Timeline

2026-09-16 - CVE-2026-77190 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77190

Vulnerability Analysis

The vulnerability resides in the Pimsm agent, the EOS process that implements PIM Sparse Mode signaling. When a switch runs PIM-SM alongside MLAG, the agent processes PIM control messages received from adjacent devices. Malformed messages trigger unexpected termination of the agent process.

EOS supervises agents and automatically restarts Pimsm after a crash. However, an attacker sending a steady stream of malformed messages forces the agent into a restart loop. During each restart window, PIM state is unavailable and multicast forwarding decisions cannot be updated. Sustained exploitation results in the loss of multicast routing for the affected switch.

The issue only affects availability of multicast services. Confidentiality and integrity are not impacted, and no unicast forwarding disruption is described in the vendor advisory.

Root Cause

The root cause is improper input validation ([CWE-20]) inside the Pimsm agent. The agent fails to safely handle malformed PIM protocol fields when MLAG is also configured, and the parsing error causes a fatal fault rather than a controlled message drop.

Attack Vector

The attack requires adjacent network access, meaning the attacker must reach the switch at the data-link layer or within the same PIM signaling domain. No authentication or user interaction is required. The attacker sends crafted PIM messages toward the vulnerable switch. Each malformed message causes the Pimsm agent to terminate. Repeated transmission produces continuous agent restarts and a sustained denial-of-service condition against multicast routing.

No public proof-of-concept exploit is listed for this CVE. Consult the vendor advisory for protocol-level details.

Detection Methods for CVE-2026-77190

Indicators of Compromise

Repeated Pimsm agent termination and restart events recorded in EOS syslog or show agent logs.
Multicast session flaps and loss of (*,G) or (S,G) state on affected MLAG peers.
Unusual volumes of PIM control-plane traffic from a single adjacent source.

Detection Strategies

Monitor EOS agent supervision events for Pimsm crashes, core file generation, and rapid restart counters.
Correlate agent restarts with inbound PIM message rates on adjacent interfaces to identify anomalous senders.
Baseline normal PIM neighbor message patterns and alert on deviations, including malformed or oversized PIM packets.

Monitoring Recommendations

Forward EOS syslog and eos-events to a centralized SIEM for continuous review of agent health.
Enable control-plane telemetry and NetFlow/sFlow on switches running PIM-SM with MLAG to capture the source of malformed messages.
Track multicast routing table churn as an early indicator of Pimsm instability.

How to Mitigate CVE-2026-77190

Immediate Actions Required

Review Arista Security Advisory #0177 and identify EOS devices running vulnerable versions with PIM-SM and MLAG configured.
Apply the fixed EOS release identified by Arista as soon as change windows allow.
Restrict Layer 2 and PIM adjacency to trusted devices only, particularly in shared or multi-tenant segments.

Patch Information

Arista provides fixed EOS releases and, where applicable, hotfix patches in Security Advisory #0177. Consult the advisory for the exact version matrix and upgrade path for each affected platform.

Workarounds

Configure PIM neighbor filters to accept messages only from trusted, known-good peers.
Apply control-plane policing (CoPP) to limit the rate of PIM messages processed by the switch.
Where feasible, disable PIM Sparse Mode on interfaces facing untrusted networks until patching is complete.

bash

# Example: restrict PIM neighbors to a defined prefix list on Arista EOS
ip prefix-list PIM-TRUSTED-NEIGHBORS seq 10 permit 10.0.0.0/24
!
interface Ethernet1
   pim ipv4 neighbor-filter PIM-TRUSTED-NEIGHBORS
!
# Verify agent health after configuration
show agent Pimsm logs
show ip pim neighbor