How do I check whether I am affected by CVE-2026-102166?

- Check your inventory or device labels for Arista Wi-Fi access points C-260 or C-250. All AP software releases on these models are affected; no configuration is needed to be exposed. - On-prem CV-CUE/Wi-Fi Manager: on the active HA node, run nerdctl exec -it wifimanager -- bash, su - config, and check upgrade_hmac_fallback_enabled for configid 1 and 3. A value of 0 means the mitigation is applied. - Other Arista APs, EOS products, CloudVision, VeloCloud and others are listed by Arista as not affected.

What is the fix for CVE-2026-102166?

No fixed release or hotfix as of Arista Security Advisory 0227 (Nov 10, 2026). Apply the vendor mitigation: disable the HMAC-based firmware verification fallback (upgrade_hmac_fallback_enabled = 0).

Post Share

CRITICAL9.4CVSS · psirt@arista.com

NO KNOWN
EXPLOIT

ARISTA WI-FI ACCESS POINTS C-260 AND C-250 · CVE-2026-102166 · Infrastructure

Arista C-260 and C-250 access points accept forged firmware via shared keys

Q: Who is not affected by CVE-2026-102166?

Not affected if: eos-products, other-ap-models.

NO FIX YET · SEE WHAT TO DO

Arista C-260 and C-250 wireless access points ship with the same cryptographic keys on every unit, used to verify firmware images and authenticate SSLP. An attacker who obtains those keys can build modified firmware that passes the device's verification checks.

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

Any team running Arista C-260 or C-250 Wi-Fi access points, on any AP software release, is affected. The access points ship with the same static keys on every unit for firmware verification and SSLP authentication, so someone who obtains the keys can build firmware that passes the checks. Arista's CVSS vector is adjacent-network, so look at who can reach the AP management network. Teams without these two models, or with other Arista AP models, can skip it.

Arista Wi-Fi Access Points C-260 and C-250All AP releases

Not affected if eos-products, other-ap-models

Who cares access-points, arista, c-250, c-260, hardcoded-credentials, title-review, wireless

02 · How to check

✓ Verified Nov 10

Check your inventory or device labels for Arista Wi-Fi access points C-260 or C-250. All AP software releases on these models are affected; no configuration is needed to be exposed.
On-prem CV-CUE/Wi-Fi Manager: on the active HA node, run nerdctl exec -it wifimanager -- bash, su - config, and check upgrade_hmac_fallback_enabled for configid 1 and 3. A value of 0 means the mitigation is applied.
Other Arista APs, EOS products, CloudVision, VeloCloud and others are listed by Arista as not affected.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202620:46 UTCNVD CVE-2026-102166
Nov 10, 202620:51 UTCInfraStack Analyst Read Arista Security Advisory 0227: all AP releases on C-260/C-250 affected, no fix or hotfix; vendor mitigation is disabling the HMAC firmware verification fallback. Not exploited per Arista; no IoCs. Social search skipped (new, vendor-found).moreless

What the sources say, verbatim

449 characters

Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image verification and SSLP authentication. An attacker who is able to access these keys would be able to create modified firmware that will pass verification checks. This vulnerability is specific to the C-260 and C-250 models; other access point models enforce digitally signed upgrade images with secure boot and are not affected by this issue.

Sources and references

NVD: CVE-2026-102166Nov 10, 2026
Arista Security Advisory 0227Advisory · arista.com

This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Arista Wi-Fi Access Points C-260 and C-250 threat the day it hits your stack.

Start free

Post Share

CRITICAL9.4CVSS · psirt@arista.com

NO KNOWN
EXPLOIT

ARISTA WI-FI ACCESS POINTS C-260 AND C-250 · CVE-2026-102166 · Infrastructure

Arista C-260 and C-250 access points accept forged firmware via shared keys

NO FIX YET · SEE WHAT TO DO

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

Arista Wi-Fi Access Points C-260 and C-250All AP releases

Not affected if eos-products, other-ap-models

Who cares access-points, arista, c-250, c-260, hardcoded-credentials, title-review, wireless

02 · How to check

✓ Verified Nov 10

Check your inventory or device labels for Arista Wi-Fi access points C-260 or C-250. All AP software releases on these models are affected; no configuration is needed to be exposed.
On-prem CV-CUE/Wi-Fi Manager: on the active HA node, run nerdctl exec -it wifimanager -- bash, su - config, and check upgrade_hmac_fallback_enabled for configid 1 and 3. A value of 0 means the mitigation is applied.
Other Arista APs, EOS products, CloudVision, VeloCloud and others are listed by Arista as not affected.

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202620:46 UTCNVD CVE-2026-102166
Nov 10, 202620:51 UTCInfraStack Analyst Read Arista Security Advisory 0227: all AP releases on C-260/C-250 affected, no fix or hotfix; vendor mitigation is disabling the HMAC firmware verification fallback. Not exploited per Arista; no IoCs. Social search skipped (new, vendor-found).moreless

What the sources say, verbatim

449 characters

Sources and references

NVD: CVE-2026-102166Nov 10, 2026
Arista Security Advisory 0227Advisory · arista.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next Arista Wi-Fi Access Points C-260 and C-250 threat the day it hits your stack.

Start free

Arista C-260 and C-250 access points accept forged firmware via shared keys

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Arista Wi-Fi Access Points C-260 and C-250 threat the day it hits your stack.

Arista C-260 and C-250 access points accept forged firmware via shared keys

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next Arista Wi-Fi Access Points C-260 and C-250 threat the day it hits your stack.

03 · The fix