What is CVE-2026-19641?

CVE-2026-19641 is a medium-severity vulnerability in Arista Networks Eos, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-09-15.

How severe is CVE-2026-19641?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Arista Networks Eos

CVE-2026-19641

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Arista Networks Eos

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output

References

psirt@arista.com

Frequently asked questions

What is CVE-2026-19641?: CVE-2026-19641 is a medium-severity vulnerability in Arista Networks Eos, classified under Improper Encoding or Escaping of Output. CVSS score: 5.3/10. Published 2026-09-15.
How severe is CVE-2026-19641?: Medium severity. CVSS v3 base score is 5.3 out of 10.