CVE-2026-19641On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

Description

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Timeline

Scores

EPSS (exploitation in 30 days)

0.47% · top 58% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.

Affected products

• Arista Networks · EOS

  • affected 4.36.0 – ≤ 4.36.0F
  • affected 4.35.0 – ≤ 4.35.5M
  • affected 4.34.0 – ≤ 4.34.7.1M
  • affected 0.0.0 – ≤ 4.33.8M

What to do

Solution: The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. For more information about upgrading see EOS User Manual: Upgrades and Downgrades. CVE-2026-19641 has been fixed in the following releases: * 4.36.1F and later releases in the 4.36.x train. * 4.35.6M and later releases in the 4.35.x train. * 4.34.8M and later releases in the 4.34.x train. * 4.33.9M and later releases in the 4.33.x train.

Workaround: The workaround is to disable password based authentication services, such as Telnet and SSH. NOTE: This workaround only works for local authentication. There is no workaround if the device requires password authentication via a remote method, e.g. Terminal Access Controller Access-Control System Plus (TACACS+), Remote Authentication Dial In User Service (RADIUS) or Lightweight Directory Access Protocol (LDAP). Use the following command to disable Telnet. switch(config)#management telnet switch(config-mgmt-telnet)#shutdown   On the client host, use the following command to generate SSH keys. client# ssh-keygen -t ecdsa -b 521 -f testkey   Copy the SSH public key to the device and add it to the local user. switch(config)#copy scp:<local_path_with_keys>/testkey.pub flash: switch(config)#username <user> sshkey file flash:testkey.pub   Add public-key as the first protocol for SSH authentication, keep keyboard-interactive as the second protocol for now. switch(config)#management ssh switch(config)#authentication protocol public-key keyboard-interactive   Once you have verified that the user can know login without a password from the client host, remove keyboard-interactive from SSH authentication protocol configuration. switch(config)#management ssh switch(config)#authentication protocol public-key   WARNING: Incorrect configuration may block logins. Make sure public-key authentication works before removing keyboard-interactive from the configuration. Instead of public key, certificate-based authentication can also be used as a workaround for local users. Please find more details about how to configure certificate-based authentication in the SSH Certificates User Guide https://www.arista.com/en/support/toi/eos-4-22-1f/14286-ssh-certificates .

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-79141 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-19641](https://cveledger.app/badge/CVE-2026-19641.svg)](https://cveledger.app/cve/CVE-2026-19641)

Record last updated 15 Sept 2026, 19:25 UTC.