{"id":"CVE-2026-120983","kind":"vulnerability","aliases":["CVE-2026-120983"],"related":[],"title":"Arista EOS: 802.1x multi-host mode with PBR lets unauthenticated hosts reach networks","description":"On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.","summary":"On Arista EOS switches running 802.1x in multi-host authenticated mode with Policy Based Routing, traffic from unauthenticated hosts can be forwarded to PBR destinations. Layer 2 and Layer 3 control packets from those hosts may also be copied to the CPU, letting unauthenticated hosts reach networks they should not.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["802.1x","arista-eos","infrastructure","network","pbr","self-hosted"],"not_affected_if":["no-802.1x-multi-host","no-dot1x","no-pbr","single-host-auth"],"how_to_check":"On the switch run 'show dot1x interface <Ethernet n>' and look for 'Host mode: multi-host authenticated'; check 'show running-config | section policy-map|pbr' for PBR policies applied. If both are present, treat as potentially exposed. Affected EOS versions are not yet confirmed from an Arista advisory; check Arista's security advisories page for this CVE id and compare 'show version'.","fix":null,"status":"open","published_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:45+00:00","updated_at":"2026-11-10T20:57:49+00:00","category":"infrastructure","confidence":0.3,"triage":{"at":"2026-11-10T20:47:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: 802.1x multi-host mode with PBR lets unauthenticated hosts reach networks","impact":"high","summary":"On Arista EOS switches running 802.1x in multi-host authenticated mode with Policy Based Routing, traffic from unauthenticated hosts can be forwarded to PBR destinations. Layer 2 and Layer 3 control packets from those hosts may also be copied to the CPU, letting unauthenticated hosts reach networks they should not.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","network","802.1x","pbr"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated hosts reach networks and send control packets to the CPU","analyst_note":"Confirm affected EOS versions and fixed releases from the Arista security advisory; the NVD entry gives none.","how_to_check":"- Check whether 802.1x is configured in multi-host authenticated mode on the switch.\n- Check whether Policy Based Routing (PBR) policies are applied on the same device.\n- Confirm the running EOS version against the affected ranges in the Arista advisory (unknown from these sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-802.1x-multi-host","no-pbr","single-host-auth"],"who_is_affected":"Only EOS switches that combine 802.1x in multi-host authenticated mode with Policy Based Routing are described as affected. Teams running Arista switches on a campus or data-center access layer should look at those two settings together. Devices without both settings are not described as exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00077,"input_tokens":4594,"output_tokens":622,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected EOS versions and fixed releases from the Arista security advisory; the NVD entry gives none.","search":"'-120983':18A,21A '-2026':17A,20A '2':61B,133C '3':64B,136C '802.1':3A,22B,38B,87C 'access':128C 'addit':131C 'affect':83C 'allow':125C 'also':71B 'arista':1A,25B,34B 'arista-eo':24B 'authent':44B,95C 'base':48B,104C 'configur':90C,101C,117C 'control':65B,137C 'copi':73B,144C 'could':123C 'cpu':76B,147C 'cve':16A,19A 'destin':59B,116C 'devic':99C 'eo':2A,26B,35B,84C 'forward':56B,113C 'get':143C 'host':7A,13A,32B,43B,53B,69B,79B,94C,110C,127C,141C 'infrastructur':27B 'layer':60B,63B,132C,135C 'let':11A,77B 'may':70B,111C,142C 'mode':8A,45B,96C 'multi':6A,42B,93C 'multi-host':5A,41B,92C 'network':15A,28B,81B,130C 'packet':66B,138C 'pbr':10A,29B,58B,106C,120C 'platform':85C 'polici':47B,103C,121C 'potenti':124C 'reach':14A,80B 'rout':49B,105C 'run':37B 'self':31B 'self-host':30B 'switch':36B 'traffic':50B,107C 'unauthent':12A,52B,78B,109C,126C,140C 'x':4A,23B,39B,88C","nicknames":[],"mitigations":[],"who_affected":"Only EOS switches that combine 802.1x in multi-host authenticated mode with Policy Based Routing are described as affected. Teams running Arista switches on a campus or data-center access layer should look at those two settings together. Devices without both settings are not described as exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["8021x","aristaeos","high","infrastructure","network","pbr","selfhosted"],"campaign_type":null,"search_a":"'-120983':18A,21A '-2026':17A,20A '802.1':3A 'arista':1A 'cve':16A,19A 'eo':2A 'host':7A,13A 'let':11A 'mode':8A 'multi':6A 'multi-host':5A 'network':15A 'pbr':10A 'reach':14A 'unauthent':12A 'x':4A","search_b":"'2':61B '3':64B '802.1':22B,38B 'also':71B 'arista':25B,34B 'arista-eo':24B 'authent':44B 'base':48B 'control':65B 'copi':73B 'cpu':76B 'destin':59B 'eo':26B,35B 'forward':56B 'host':32B,43B,53B,69B,79B 'infrastructur':27B 'layer':60B,63B 'let':77B 'may':70B 'mode':45B 'multi':42B 'multi-host':41B 'network':28B,81B 'packet':66B 'pbr':29B,58B 'polici':47B 'reach':80B 'rout':49B 'run':37B 'self':31B 'self-host':30B 'switch':36B 'traffic':50B 'unauthent':52B,78B 'x':23B,39B","search_c":"'2':133C '3':136C '802.1':87C 'access':128C 'addit':131C 'affect':83C 'allow':125C 'authent':95C 'base':104C 'configur':90C,101C,117C 'control':137C 'copi':144C 'could':123C 'cpu':147C 'destin':116C 'devic':99C 'eo':84C 'forward':113C 'get':143C 'host':94C,110C,127C,141C 'layer':132C,135C 'may':111C,142C 'mode':96C 'multi':93C 'multi-host':92C 'network':130C 'packet':138C 'pbr':106C,120C 'platform':85C 'polici':103C,121C 'potenti':124C 'rout':105C 'traffic':107C 'unauthent':109C,126C,140C 'x':88C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120983","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120983","severity":null,"published_at":"2026-11-10T20:18:53+00:00","modified_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120983:2732","url":null,"severity":null,"published_at":"2026-11-10T20:57:49+00:00","modified_at":"2026-11-10T20:57:49+00:00","first_seen_at":"2026-11-10T20:57:49+00:00","fetched_at":"2026-11-10T20:57:49+00:00","note":"No Arista advisory found for this CVE: checked SA0142, SA0148 index (SA0149-182), SA0150 and searched by description; none cover 802.1x multi-host authenticated + PBR. Affected versions and fixes remain unknown. Nothing verified. Settle by finding the Arista advisory (arista.com/en/support/advisories-notices) or the NVD CNA references."}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}