CVE-2026-121371: Security Advisory 0218

Published Nov 10, 2026

Updated

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

Affected Software

1 affected component

Arista EOS

Event History

Nov 10, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Arista EOS deployments are exposed when running an affected EOS version with the eAPI service enabled. The attack can be performed remotely over the network.

Does exploitation require credentials or user interaction?

No. An unauthenticated attacker can exploit the issue using a specially crafted HTTP request, and no user interaction is required.

What could an attacker access?

An attacker may read arbitrary files from the switch filesystem, including files containing sensitive credentials.

CVE-2026-121371: Security Advisory 0218

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require credentials or user interaction?

What could an attacker access?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require credentials or user interaction?

What could an attacker access?