---
id: "CVE-2026-120976"
page: "https://infrastack.ai/live/CVE-2026-120976"
kind: "vulnerability"
aliases: ["CVE-2026-120976"]
title: "Arista EOS: diagnostic logs during switch upgrade can expose MACsec authentication keys"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "Arista EOS", "fixed": [], "affected": ">= 4.22.0F, < 4.32.0F; 4.32.x; >= 4.33.0F, <= 4.33.9M; >= 4.34.0F, <= 4.34.8M; >= 4.35.0F, <= 4.35.6M; >= 4.36.0F, <= 4.36.2F", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["802.1x", "arista-eos", "infrastructure", "macsec", "network-switches", "smart-switch-upgrade"]
not_affected_if: ["no-8021x", "no-macsec", "no-ssu", "static-keys", "static-macsec-keys"]
published_at: "2026-11-10T20:18:52+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T21:00:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120976", "first_seen_at": "2026-11-10T20:46:02+00:00"}, {"source": "analyst", "url": "https://cvepremium.circl.lu/vuln/cve-2026-120976", "first_seen_at": "2026-11-10T21:00:21+00:00", "cites": ["https://cvepremium.circl.lu/vuln/cve-2026-120976"]}]
exploit_sources: []
---

# Arista EOS: diagnostic logs during switch upgrade can expose MACsec authentication keys

Link for people: https://infrastack.ai/live/CVE-2026-120976 (this .md is for agents)

On Arista EOS switches using 802.1X with MACsec and dynamically derived keys, sensitive authentication data can be written to diagnostic data during a Smart Switch Upgrade reload. An attacker with administrative access to the device who obtains that diagnostic data could recover the material and weaken confidentiality and integrity of MACsec-protected traffic on the affected link.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arista EOS affected >= 4.22.0F, < 4.32.0F; 4.32.x; >= 4.33.0F, <= 4.33.9M; >= 4.34.0F, <= 4.34.8M; >= 4.35.0F, <= 4.35.6M; >= 4.36.0F, <= 4.36.2F fixed no fixed version listed

## How to check

On each EOS switch: check the version with 'show version' against the affected ranges (4.22.0F up to 4.32.0F exclusive, 4.32.x, 4.33.x up to 4.33.9M, 4.34.x up to 4.34.8M, 4.35.x up to 4.35.6M, 4.36.x up to 4.36.2F). Then check for 802.1X plus a MACsec profile using 'key source dot1x' ('show running-config | section mac security', 'show dot1x'). Only devices that have run SSU are exposed. Exact fixed releases: see Arista Security Advisory 0216.

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120976
- 2026-11-10T21:00:21+00:00 analyst https://cvepremium.circl.lu/vuln/cve-2026-120976 — Arista Security Advisory 0216 (CNA record mirrored by CIRCL; arista.com page itself not retrievable, Client Challenge). Affected EOS ranges read from CNA record; fix versions not found, so fix left unknown and nothing marked verified.

## Documents

- [describes] CVE-2026-120976 (Arista CNA record, Security Advisory 0216) - Vulnerability-Lookup https://cvepremium.circl.lu/vuln/cve-2026-120976

## From the sources

On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).

An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.

The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_