---
id: "CVE-2026-120983"
page: "https://infrastack.ai/live/CVE-2026-120983"
kind: "vulnerability"
aliases: ["CVE-2026-120983"]
title: "Arista EOS: 802.1x multi-host mode with PBR lets unauthenticated hosts reach networks"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["802.1x", "arista-eos", "infrastructure", "network", "pbr", "self-hosted"]
not_affected_if: ["no-802.1x-multi-host", "no-dot1x", "no-pbr", "single-host-auth"]
published_at: "2026-11-10T20:18:53+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:57:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120983", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:57:49+00:00"}]
exploit_sources: []
---

# Arista EOS: 802.1x multi-host mode with PBR lets unauthenticated hosts reach networks

Link for people: https://infrastack.ai/live/CVE-2026-120983 (this .md is for agents)

On Arista EOS switches running 802.1x in multi-host authenticated mode with Policy Based Routing, traffic from unauthenticated hosts can be forwarded to PBR destinations. Layer 2 and Layer 3 control packets from those hosts may also be copied to the CPU, letting unauthenticated hosts reach networks they should not.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

On the switch run 'show dot1x interface <Ethernet n>' and look for 'Host mode: multi-host authenticated'; check 'show running-config | section policy-map|pbr' for PBR policies applied. If both are present, treat as potentially exposed. Affected EOS versions are not yet confirmed from an Arista advisory; check Arista's security advisories page for this CVE id and compare 'show version'.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120983
- 2026-11-10T20:57:49+00:00 analyst — No Arista advisory found for this CVE: checked SA0142, SA0148 index (SA0149-182), SA0150 and searched by description; none cover 802.1x multi-host authenticated + PBR. Affected versions and fixes remain unknown. Nothing verified. Settle by finding the Arista advisory (arista.com/en/support/advisories-notices) or the NVD CNA references.

## From the sources

On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_