Is CVE-2026-102169 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102169 being exploited in the wild.

How severe is CVE-2026-102169?

Medium severity, with a CVSS score of 6.5, published 6 October 2026.

Which products and versions are affected?

Arista Wi-Fi Access Point 22.0.1F-32 and earlier in 22.x; 21.3.0M-13 and earlier in 21.x; all prior releases.

How is CVE-2026-102169 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-102169?

Check whether you run Arista Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102169: Arista Wi-Fi Access Point denial of service in Captive Portal

CVE-2026-102169 · Severity: medium · CVSS 6.5 · Published 2026-10-06

Arista Wi-Fi access points with Captive Portal enabled are vulnerable to denial-of-service attacks from unauthenticated wireless clients. An attacker can send specially crafted HTTP requests to crash the portal service, and sustained attacks prevent legitimate users from authenticating through the captive portal. This affects access point availability but does not allow remote code execution or data theft.

Technologies: Arista Wi-Fi Access Point. Vendors: Arista.

Quick answers

Is CVE-2026-102169 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102169 being exploited in the wild.
How severe is CVE-2026-102169?: Medium severity, with a CVSS score of 6.5, published 6 October 2026.
Which products and versions are affected?: Arista Wi-Fi Access Point 22.0.1F-32 and earlier in 22.x; 21.3.0M-13 and earlier in 21.x; all prior releases.
Is there a fix for CVE-2026-102169?: Yes: fixed in Wi-Fi Access Point 22.1.1F and later in 22.x; 21.4.0M-12 and later in 21.x. Until then: If Captive Portal is not required, disable it on all SSIDs to eliminate exposure. If Captive Portal functionality is required, upgrade to a patched firmware version as no configuration-based mitigation is available.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102169 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-102169?: Check whether you run Arista Wi-Fi Access Point at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Wi-Fi Access Point 22.1.1F and later in 22.x; 21.4.0M-12 and later in 21.x

If Captive Portal is not required, disable it on all SSIDs to eliminate exposure. If Captive Portal functionality is required, upgrade to a patched firmware version as no configuration-based mitigation is available.</anigation> <parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}]

Technical details

Two distinct vulnerabilities (CVE-2026-102168 and CVE-2026-102169) allow an unauthenticated wireless client to crash the portal service with a single crafted HTTP request via an adjacent network attack vector. CVE-2026-102168 involves an integer underflow flaw, while CVE-2026-102169 involves a NULL pointer dereference; the latter can be exploited repeatedly to cause persistent denial of service. Both require Captive Portal to be enabled and a client associated with a captive-portal-enabled SSID.

Affected products

Arista Wi-Fi Access Point 22.0.1F-32 and earlier in 22.x; 21.3.0M-13 and earlier in 21.x; all prior releases

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.