Arista EOS: crafted password creates orphan sessions until logins are exhausted

CVSS 6.9CVE-2026-19641Firmware, BMC & network fabriccurated

Impact

A specially crafted password leaves behind orphan authentication sessions. Repeating it exhausts the switch's authentication resources and legitimate administrators can no longer log in. Traffic keeps forwarding, but the operator loses the CLI and API path to the switch - which is exactly the access needed to diagnose a fabric problem or drain a rack. On a fabric where the same automation credentials hit every switch, one attacker who can reach the management address can lock the operator out of a wide slice of the fleet. Arista found this internally and reports no known exploitation.

Who can reach it

Network-reachable, no authentication required - the attacker only needs to reach the switch's login service (SSH, eAPI or console server) and submit crafted passwords.

What to do

Upgrade to the fixed EOS release or hotfix named in Arista security advisory 0152; the record does not state a fixed version. In the meantime, keep switch management interfaces on an isolated management VLAN with control-plane ACLs limiting who can attempt authentication at all.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-19641 https://www.arista.com/en/support/advisories-notices/security-advisory/24708-security-advisory-0152

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.