CVE-2026-102166: Security Advisory 0227

Published Nov 10, 2026

Updated

Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.

Affected Software

2 affected components

Arista C-260 access point

Arista C-250 access point

Event History

Nov 10, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Only Arista C-260 and C-250 access points are identified as affected. Other access point models use digitally signed upgrade images with secure boot and are not affected by this issue.

What does an attacker need to exploit this issue?

The attacker must be able to obtain the fleet-wide static cryptographic keys. With those keys, they can create modified firmware images that pass the affected devices' verification checks.

What is the likely impact if exploitation succeeds?

An attacker could install modified firmware that is accepted as valid by the affected access points. The supplied severity vector indicates potential high impact to confidentiality, integrity, and availability.

CVE-2026-102166: Security Advisory 0227

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?