Quick answers
- Is CVE-2026-120983 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120983 being exploited in the wild.
- How severe is CVE-2026-120983?
- High severity, with a CVSS score of 7.6, published 10 November 2026.
- Which products and versions are affected?
- Arista Eos 4.36.1F and earlier in 4.36.x; 4.35.5M and earlier in 4.35.x; 4.34.7M and earlier in 4.34.x; 4.33.9M and earlier in 4.33.x; all 4.32.x; all End of Life trains.
- Is there a fix for CVE-2026-120983?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-120983 attacked?
- It is attacked from the adjacent network, in a network appliance.
- Am I affected by CVE-2026-120983?
- Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is an improper access control vulnerability (CWE-284) in EOS platforms when both 802.1x multi-host authenticated mode and Policy Based Routing (PBR) are configured on the same VLAN. Unauthenticated hosts can bypass authentication checks and have their traffic forwarded according to PBR policies, and control packets may be copied to the CPU. The vulnerability requires the specific configuration of both 802.1x and PBR on the same ingress VLAN with at least one authenticated host present.
Affected products
- Arista EOS 4.36.1F and earlier in 4.36.x; 4.35.5M and earlier in 4.35.x; 4.34.7M and earlier in 4.34.x; 4.33.9M and earlier in 4.33.x; all 4.32.x; all End of Life trains
Timeline
- 2026-11-10: disclosed