01 Record
CVE-2026-19640
Security Advisory 0170
LowPUBLISHEDCNA: Arista
CNA base score2.3 CVSS v4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
02 Description
Security Advisory 0170
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- Not scored by EPSS
- EPSS percentile
- Not scored by EPSS
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Not recorded
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2026-09-16 09:11Z1 HR AGO
- Last updated
- 2026-09-16 10:13Z22 MIN AGO
- Reserved
- 2026-08-12
- Assigning CNA
- Arista
- Record state
- PUBLISHED
- Severity
- Low (CVSS 2.3)
- CNA CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-863Incorrect AuthorizationClass
- Data version
- 5.2
- Document digest
- 9f26c88d659e429ed86ef93d9159430fa35aa18948b155dcc8fb0e5d31b7d004
05 Affected products
VendorProductVersionsPlatforms
Arista NetworksEOS4.36.0F to 4.36.0.1F, 4.35.0F to 4.35.5M, 4.34.0F to 4.34.7M, 4.33.0F to 4.33.8M, 4.24.0F to < 4.33.0F710 Series, 720D Series, 720XP/722XPM Series, 750X Series, 7010TX Series, 7020R/R4 Series, 7130 Series running EOS, 7170 Series, 7050X3/X4 Series, 7060X/X2/X4/X5/X6 Series, 7260X/X3 Series, 7280R/R2/R3/R4 Series, 7300X/X3 Series, 7320X Series, 7358X4 Series, 7368X4 Series, 7388X5 Series, 7500R/R2/R3 Series, 7800R3/R4 Series, 7700R4 Series, AWE 5000 Series, AWE 7200R Series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange, virtual or physical appliance
06 References
- www.arista.comSecurity Advisory 0170https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170
07 Remediation
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below. CVE-2026-19640 has been fixed in the following releases: - 4.36.1F and later releases in the 4.36.x train - 4.35.6M and later releases in the 4.35.x train - 4.34.8M and later releases in the 4.34.x train - 4.33.9M and later releases in the 4.33.x train No hotfix is available for this issue.