Is CVE-2026-102166 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102166 being exploited in the wild.

How severe is CVE-2026-102166?

High severity, with a CVSS score of 8.8, published 10 November 2026.

Which products and versions are affected?

Arista C-250 Wi-Fi Access Point all; Arista C-260 Wi-Fi Access Point all.

How is CVE-2026-102166 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-102166?

Check whether you run Arista C-250 Wi-Fi Access Point or Arista C-260 Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102166: Arista C-260 and C-250 hardcoded cryptographic keys in firmware verification

CVE-2026-102166 · Severity: high · CVSS 8.8 · Published 2026-11-10

Arista C-260 and C-250 Wi-Fi access points contain hardcoded cryptographic keys shared across all units, which are used to verify firmware authenticity and SSLP authentication. An attacker obtaining these keys could create malicious firmware that passes security checks, potentially gaining complete control over affected access points across an organization's network.

Vendors: Arista.

Quick answers

Is CVE-2026-102166 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102166 being exploited in the wild.
How severe is CVE-2026-102166?: High severity, with a CVSS score of 8.8, published 10 November 2026.
Which products and versions are affected?: Arista C-250 Wi-Fi Access Point all; Arista C-260 Wi-Fi Access Point all.
Is there a fix for CVE-2026-102166?: No fixed version is recorded yet. Disable the HMAC-based firmware verification fallback path by setting the upgrade_hmac_fallback_enabled parameter to 0 (for both configid 1 and 3) and restarting sserverd to enforce mandatory digital signature verification for all firmware upgrades.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-10" } ] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-102166 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-102166?: Check whether you run Arista C-250 Wi-Fi Access Point or Arista C-260 Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable the HMAC-based firmware verification fallback path by setting the upgrade_hmac_fallback_enabled parameter to 0 (for both configid 1 and 3) and restarting sserverd to enforce mandatory digital signature verification for all firmware upgrades.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-11-10" } ]

Technical details

The vulnerability stems from the use of fleet-wide static cryptographic keys (CWE-798: hardcoded credentials) for both firmware image verification and SSLP authentication on C-260 and C-250 models. An attacker with access to these keys can bypass firmware verification mechanisms and create modified firmware that will pass security checks. The attack requires adjacent network access to deploy the malicious firmware, but no authentication or user interaction is needed once access is gained.

Affected products

Arista C-260 Wi-Fi Access Point all
Arista C-250 Wi-Fi Access Point all

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25049-security-advisory-0227

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.