CVE-2026-75944
published 2026-09-14CVE-2026-75944: A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale…
PriorityP412low2.6CVSS 3.1
AVAACHPRLUINSUCNILAN
EPSS
0.15%
4.3th percentile
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arista_networks | eos | 4.36.0 – 4.36.1F | — |
CVSS provenance
nvdv3.12.6LOWCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.6MEDIUMCVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Arista EOS up to 4.36.1F AclAgent race condition (EUVD-2026-78213)
vuldb·2026-09-15·CVSS 2.6
CVE-2026-75944 [LOW] Arista EOS up to 4.36.1F AclAgent race condition (EUVD-2026-78213)
A vulnerability labeled as very critical has been found in Arista EOS up to 4.36.1F. This vulnerability affects unknown code of the component AclAgent. Such manipulation leads to race condition.
This vulnerability is listed as CVE-2026-75944. The attack may be performed from remote. There is no available exploit.
GHSA
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system.
ghsa_unreviewed·2026-09-15
CVE-2026-75944 [MEDIUM] CWE-459 A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system.
A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-09-14
Published