{"id":"CVE-2026-120976","kind":"vulnerability","aliases":["CVE-2026-120976"],"related":[],"title":"Arista EOS: diagnostic logs during switch upgrade can expose MACsec authentication keys","description":"On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).\n\nAn attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.\n\nThe vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.","summary":"On Arista EOS switches using 802.1X with MACsec and dynamically derived keys, sensitive authentication data can be written to diagnostic data during a Smart Switch Upgrade reload. An attacker with administrative access to the device who obtains that diagnostic data could recover the material and weaken confidentiality and integrity of MACsec-protected traffic on the affected link.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Arista EOS","fixed":[],"affected":">= 4.22.0F, < 4.32.0F; 4.32.x; >= 4.33.0F, <= 4.33.9M; >= 4.34.0F, <= 4.34.8M; >= 4.35.0F, <= 4.35.6M; >= 4.36.0F, <= 4.36.2F","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["802.1x","arista-eos","infrastructure","macsec","network-switches","smart-switch-upgrade"],"not_affected_if":["no-8021x","no-macsec","no-ssu","static-keys","static-macsec-keys"],"how_to_check":"On each EOS switch: check the version with 'show version' against the affected ranges (4.22.0F up to 4.32.0F exclusive, 4.32.x, 4.33.x up to 4.33.9M, 4.34.x up to 4.34.8M, 4.35.x up to 4.35.6M, 4.36.x up to 4.36.2F). Then check for 802.1X plus a MACsec profile using 'key source dot1x' ('show running-config | section mac security', 'show dot1x'). Only devices that have run SSU are exposed. Exact fixed releases: see Arista Security Advisory 0216.","fix":null,"status":"open","published_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","triaged_at":"2026-11-10T20:47:55+00:00","updated_at":"2026-11-10T21:00:21+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:47:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Arista EOS: diagnostic logs during switch upgrade can expose MACsec authentication keys","impact":"medium","summary":"On Arista EOS switches using 802.1X with MACsec and dynamically derived keys, sensitive authentication data can be written to diagnostic data during a Smart Switch Upgrade reload. An attacker with administrative access to the device who obtains that diagnostic data could recover the material and weaken confidentiality and integrity of MACsec-protected traffic on the affected link.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","macsec","802.1x","network-switches"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Admin attacker recovers MACsec authentication material from diagnostic data","analyst_note":"Find the affected EOS versions and the vendor fix in the Arista advisory for CVE-2026-120976; the NVD record has no product ranges.","how_to_check":"- Confirm the platform runs Arista EOS with 802.1X and MACsec using dynamically derived keys (`show dot1x`, `show macsec`).\n- Check whether Smart Switch Upgrade (SSU) has been used on the device.\n- unknown for the exact affected EOS versions: the sources do not list them.","plain_action":"","product_name":"Arista EOS","needs_analyst":true,"not_affected_if":["no-macsec","static-keys","no-ssu","no-8021x"],"who_is_affected":"Exposure requires EOS switches using 802.1X authentication with MACsec and dynamically derived keys, and an active 802.1X session used for MACsec during or after an SSU reload. An attacker must already hold administrative access to the device and obtain its diagnostic data. Networks without 802.1X-based MACsec, or without SSU, are not described as exposed.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00082,"input_tokens":4648,"output_tokens":710,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected EOS versions and the vendor fix in the Arista advisory for CVE-2026-120976; the NVD record has no product ranges.","search":"'-120976':15A,18A '-2026':14A,17A '802.1':21B,40B,102C,176C 'access':67B,130C 'activ':175C 'administr':66B,129C 'affect':92B,95C,137C,160C 'arista':1A,19A,24B,36B,98C 'arista-eo':23B 'attack':64B,127C 'authent':11A,49B,104C,112C,143C 'compromis':148C 'confidenti':82B,150C 'could':76B,140C,146C 'cve':13A,16A 'data':50B,56B,75B,119C,139C 'deriv':46B,109C 'devic':70B,133C 'diagnost':3A,55B,74B,118C,138C 'dynam':45B,108C 'eo':2A,25B,37B,99C 'eos':20A 'expos':9A,166C 'ieee':101C 'inform':113C,144C 'infrastructur':26B 'integr':84B,152C 'key':12A,47B,110C 'link':93B,161C 'log':4A 'macsec':10A,27B,43B,87B,106C,157C,181C 'macsec-protect':86B 'materi':79B 'may':114C 'network':29B 'network-switch':28B 'obtain':72B,135C 'platform':96C 'potenti':147C 'present':183C 'protect':88B,155C 'record':116C 'recov':77B,141C 'reload':62B,172C 'run':97C 'sensit':48B,111C,142C 'session':178C 'smart':32B,59B,122C 'smart-switch-upgrad':31B 'ssu':125C,171C 'switch':6A,30B,33B,38B,60B,123C 'traffic':89B,154C 'upgrad':7A,34B,61B,124C 'use':39B,107C,179C 'vulner':163C 'weaken':81B 'written':53B 'x':22B,41B,103C,177C","nicknames":[],"mitigations":[],"who_affected":"Arista EOS switches running IEEE 802.1X with MACsec using dynamically derived keys (key source dot1x). Sensitive authentication data may be recorded in diagnostic data during and after a Smart Switch Upgrade (SSU) reload while an active 802.1X session for MACsec exists. An attacker needs local administrative access to the device and the diagnostic data. Skip it if you do not use MACsec with 802.1X-derived keys or never run SSU.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["aristaeos","eos"],"ptokens":["arista","eos"],"labels":["8021x","aristaeos","high","infrastructure","macsec","networkswitches","smartswitchupgrade","vendor"],"campaign_type":null,"search_a":"'-120976':15A,18A '-2026':14A,17A 'arista':1A,19A 'authent':11A 'cve':13A,16A 'diagnost':3A 'eo':2A 'eos':20A 'expos':9A 'key':12A 'log':4A 'macsec':10A 'switch':6A 'upgrad':7A","search_b":"'802.1':21B,40B 'access':67B 'administr':66B 'affect':92B 'arista':24B,36B 'arista-eo':23B 'attack':64B 'authent':49B 'confidenti':82B 'could':76B 'data':50B,56B,75B 'deriv':46B 'devic':70B 'diagnost':55B,74B 'dynam':45B 'eo':25B,37B 'infrastructur':26B 'integr':84B 'key':47B 'link':93B 'macsec':27B,43B,87B 'macsec-protect':86B 'materi':79B 'network':29B 'network-switch':28B 'obtain':72B 'protect':88B 'recov':77B 'reload':62B 'sensit':48B 'smart':32B,59B 'smart-switch-upgrad':31B 'switch':30B,33B,38B,60B 'traffic':89B 'upgrad':34B,61B 'use':39B 'weaken':81B 'written':53B 'x':22B,41B","search_c":"'802.1':102C,176C 'access':130C 'activ':175C 'administr':129C 'affect':95C,137C,160C 'arista':98C 'attack':127C 'authent':104C,112C,143C 'compromis':148C 'confidenti':150C 'could':140C,146C 'data':119C,139C 'deriv':109C 'devic':133C 'diagnost':118C,138C 'dynam':108C 'eo':99C 'expos':166C 'ieee':101C 'inform':113C,144C 'integr':152C 'key':110C 'link':161C 'macsec':106C,157C,181C 'may':114C 'obtain':135C 'platform':96C 'potenti':147C 'present':183C 'protect':155C 'record':116C 'recov':141C 'reload':172C 'run':97C 'sensit':111C,142C 'session':178C 'smart':122C 'ssu':125C,171C 'switch':123C 'traffic':154C 'upgrad':124C 'use':107C,179C 'vulner':163C 'x':103C,177C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:52+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120976","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120976","severity":null,"published_at":"2026-11-10T20:18:52+00:00","modified_at":"2026-11-10T20:18:52+00:00","first_seen_at":"2026-11-10T20:46:02+00:00","fetched_at":"2026-11-10T20:46:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120976:2736","url":"https://cvepremium.circl.lu/vuln/cve-2026-120976","severity":null,"published_at":"2026-11-10T21:00:21+00:00","modified_at":"2026-11-10T21:00:21+00:00","first_seen_at":"2026-11-10T21:00:21+00:00","fetched_at":"2026-11-10T21:00:21+00:00","note":"Arista Security Advisory 0216 (CNA record mirrored by CIRCL; arista.com page itself not retrievable, Client Challenge). Affected EOS ranges read from CNA record; fix versions not found, so fix left unknown and nothing marked verified.","cites":["https://cvepremium.circl.lu/vuln/cve-2026-120976"]}],"documents":[{"id":118466,"url":"https://cvepremium.circl.lu/vuln/cve-2026-120976","title":"CVE-2026-120976 (Arista CNA record, Security Advisory 0216) - Vulnerability-Lookup","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}