ARISTA EOS · CVE-2026-120976 · Infrastructure
NO FIX YET
On Arista EOS switches using 802.1X with MACsec and dynamically derived keys, sensitive authentication data can be written to diagnostic data during a Smart Switch Upgrade reload. An attacker with administrative access to the device who obtains that diagnostic data could recover the material and weaken confidentiality and integrity of MACsec-protected traffic on the affected link.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Arista EOS switches running IEEE 802.1X with MACsec using dynamically derived keys (key source dot1x). Sensitive authentication data may be recorded in diagnostic data during and after a Smart Switch Upgrade (SSU) reload while an active 802.1X session for MACsec exists. An attacker needs local administrative access to the device and the diagnostic data. Skip it if you do not use MACsec with 802.1X-derived keys or never run SSU.
Not affected if no-8021x, no-macsec, no-ssu, static-keys, static-macsec-keys
Who cares 802.1x, arista-eos, macsec, network-switches, smart-switch-upgrade
show version against the affected ranges (4.22.0F up to 4.32.0F exclusive, 4.32.x, 4.33.x up to 4.33.9M, 4.34.x up to 4.34.8M, 4.35.x up to 4.35.6M, 4.36.x up to 4.36.2F)key source dot1x (show running-config | section mac security, show dot1x)Posts are quoted with a link to the original. They are data to us, never instructions.
On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).
An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.
The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
No fix yet, per the sources.