CVE-2026-120977: Arista EOS DHCP device profiling spoofing in 802.1X

CVE-2026-120977 · Severity: high · CVSS 8.2 · Published 2026-11-10

Arista EOS is network switching and routing software used in enterprise data center and campus networks. When 802.1X authentication and DHCP device profiling are both enabled, a network-adjacent attacker can send a crafted DHCP packet to spoof a device profile, potentially allowing an authenticated user to gain unauthorized access to network segments with elevated privileges. This could enable lateral movement within a network or access to restricted resources.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-120977 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-120977 being exploited in the wild.
How severe is CVE-2026-120977?
High severity, with a CVSS score of 8.2, published 10 November 2026.
Which products and versions are affected?
Arista Eos 4.36.2F and earlier in 4.36.x train, 4.35.5M and earlier in 4.35.x train, 4.34.7M and earlier in 4.34.x train, 4.33.9M and earlier in 4.33.x train, all 4.32.x releases, 4.31.2F and later in 4.31.x train.
Is there a fix for CVE-2026-120977?
Yes: fixed in EOS 4.37.0F and later, 4.36.3M and later, 4.35.6M and later, 4.34.8M and later, 4.33.10M and later. Until then: There is no workaround to prevent this behavior; upgrade to a remediated software version at your earliest convenience. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120977 attacked?
It is attacked from the adjacent network, in an operating system.
Am I affected by CVE-2026-120977?
Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: EOS 4.37.0F and later, 4.36.3M and later, 4.35.6M and later, 4.34.8M and later, 4.33.10M and later

There is no workaround to prevent this behavior; upgrade to a remediated software version at your earliest convenience.

Technical details

The vulnerability stems from reliance on untrusted DHCP packet inputs in security decisions (CWE-807). A network-adjacent attacker without authentication can send a crafted DHCP packet to a device running EOS with 802.1X and DHCP profiling enabled, causing the device to record a spoofed device profile associated with the attacker's chosen identity. This spoofed profile can then be used by an authenticated supplicant to bypass authorization policies and access network segments intended for different device classes.

Affected products

  • Arista EOS 4.36.2F and earlier in 4.36.x train, 4.35.5M and earlier in 4.35.x train, 4.34.7M and earlier in 4.34.x train, 4.33.9M and earlier in 4.33.x train, all 4.32.x releases, 4.31.2F and later in 4.31.x train

Timeline

  • 2026-11-10: disclosed: Security Advisory 0217 published; CVE-2026-120977 disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.