CVE-2026-77191: Network Authorization Policy Bypass Flaw

CVE-2026-77191 Overview

CVE-2026-77191 describes a race condition in network access control enforcement. An authenticated supplicant on an adjacent network can transmit unrestricted traffic during a brief window between authentication completion and Access Control List (ACL) enforcement. This gap ranges from milliseconds to seconds. The flaw is classified under [CWE-862] Missing Authorization. Arista Networks documented the issue in Security Advisory 0150.

Critical Impact
An authenticated user on an adjacent Layer 2 network can briefly bypass assigned network authorization policies and send traffic outside the intended ACL scope before enforcement engages.

Affected Products

Refer to Arista Security Advisory 0150 for the authoritative list of affected platforms and software versions.

Discovery Timeline

2026-09-14 - CVE-2026-77191 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77191

Vulnerability Analysis

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) style authorization gap. When a supplicant completes 802.1X or comparable port-based authentication, the switch must associate the session with a downloadable or dynamically assigned ACL. The vulnerable behavior transitions the port to a forwarding state before the assigned ACL is fully programmed into the data plane.

During that window, packets from the newly authenticated station traverse the switch without the intended filtering. The authenticated user retains a valid identity, so traffic is not dropped as unauthenticated, but the restrictions tied to that identity are not yet applied. This produces short-lived unrestricted egress from the supplicant into segments the policy would otherwise deny.

The scope is limited by the attack vector. Exploitation requires an adjacent network position and valid supplicant credentials, and the exposure window closes within seconds once the ACL is applied.

Root Cause

The root cause is missing authorization enforcement during a transient state ([CWE-862]). Session state machines transition to authorized before the corresponding policy artifact, the ACL, becomes active in hardware or software forwarding paths. There is no interlock that holds forwarding until policy programming completes.

Attack Vector

An attacker with valid credentials for the network authenticates a supplicant against the switch port. Immediately after authentication succeeds, the attacker generates traffic destined for resources normally blocked by the assigned ACL. Any packets that traverse before ACL programming completes bypass policy enforcement. No specific exploitation code has been published, and no proof-of-concept is listed in public repositories.

Detection Methods for CVE-2026-77191

Indicators of Compromise

Flow records showing traffic from a supplicant MAC or IP to destinations that the assigned ACL should have blocked, occurring within seconds of an authentication success event.
802.1X or RADIUS accounting logs correlating an Access-Accept event with immediate outbound sessions to restricted subnets.
Repeated authentication and reauthentication cycles from the same supplicant, which extend the cumulative exposure window.

Detection Strategies

Correlate RADIUS Access-Accept timestamps with NetFlow or sFlow records to identify traffic hitting denied destinations during the enforcement gap.
Baseline expected post-authentication traffic per supplicant role and alert on deviations toward restricted VLANs or management planes.
Enable ACL hit counters and log denied flows on downstream enforcement points to catch traffic that should never have transited the access layer.

Monitoring Recommendations

Ingest switch authentication logs and flow telemetry into a centralized analytics platform to enable time-window correlation.
Monitor for excessive rapid reauthentication events from the same endpoint, which can be used to repeatedly reopen the enforcement gap.
Alert when ACL programming latency, as reported by device telemetry, exceeds expected thresholds.

How to Mitigate CVE-2026-77191

Immediate Actions Required

Review Arista Security Advisory 0150 and identify affected switch models and software versions in your environment.
Apply the fixed software release documented in the vendor advisory during your next maintenance window.
Enforce defense-in-depth by placing restrictive ACLs on distribution or firewall layers, so access-layer race conditions do not grant reach to sensitive segments.

Patch Information

Arista Networks published remediation guidance in Security Advisory 0150. Refer to the advisory for fixed EOS versions and applicable hotfix packages. No patch identifier is included in the NVD record beyond the vendor advisory reference.

Workarounds

Assign supplicants to a restricted VLAN by default and use dynamic VLAN assignment tied to identity, reducing what an authenticated session can reach even without ACL enforcement.
Deploy downstream stateful filtering at aggregation or firewall layers so access-layer transient traffic still hits an enforcement point.
Increase RADIUS reauthentication intervals to avoid frequently reopening the enforcement window, and disable unnecessary supplicant credentials.

bash

# Configuration example
# Refer to Arista Security Advisory 0150 for vendor-specific configuration guidance.