CVE-2026-19641: On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit

Vulnerability summary

CVE-2026-19641 is a medium (CVSS 6.9) Improper Encoding or Escaping of Output vulnerability in arista networks eos. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.5% of scored vulnerabilities.

Timeline

1. 15-09-2026
   PublishedVulnerability first disclosed.
2. 15-09-2026
   Last modifiedVulnerability information updated.

Description

On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

• CWE-116Improper Encoding or Escaping of OutputThe product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.