CVE-2026-19641: On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

Published Sep 15, 2026

Updated

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.

This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

Affected Software

1 affected component

Arista EOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.33.9M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.34.8M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.35.6M
Upgrade
Upgrade Arista EOS to a version that resolves this vulnerability.
Fixed in 4.36.1F

Event History

Sep 15, 2026

CVE Published

via MITRE·06:17 PM

Data Sourced

via MITRE·06:17 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Affected platforms running Arista EOS are exposed when password authentication is configured. The provided information does not identify affected versions or platforms.

What does an attacker need to do to cause impact?

An attacker needs network access and can trigger the issue without authentication or user interaction by submitting a specially crafted password. Repeated attempts can create orphan authentication sessions and exhaust authentication resources.

What is the operational impact if exploitation succeeds?

Legitimate users may be unable to log in to the device after available authentication resources are exhausted. The supplied data indicates availability impact only, with no confidentiality or integrity impact stated.

Is there evidence of exploitation in customer environments?

Arista states that it is not aware of malicious exploitation of this vulnerability in customer networks.