CVE-2026-120983 · Infrastructure
NO FIX YET
On Arista EOS switches running 802.1x in multi-host authenticated mode with Policy Based Routing, traffic from unauthenticated hosts can be forwarded to PBR destinations. Layer 2 and Layer 3 control packets from those hosts may also be copied to the CPU, letting unauthenticated hosts reach networks they should not.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only EOS switches that combine 802.1x in multi-host authenticated mode with Policy Based Routing are described as affected. Teams running Arista switches on a campus or data-center access layer should look at those two settings together. Devices without both settings are not described as exposed.
Not affected if no-802.1x-multi-host, no-dot1x, no-pbr, single-host-auth
Who cares 802.1x, arista-eos, network, pbr, self-hosted
show dot1x interface <Ethernet n> and look for Host mode: multi-host authenticated; check show running-config | section policy-map|pbr for PBR policies applieds security advisories page for this CVE id and compare show version'No fix yet, per the sources.
On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.
This page as .md · .json · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.