CVE-2026-19640CWE-863broken-access-control

CVE-2026-19640

Medium · published September 16, 2026

CVSS v3.1
4.2
EPSS
0%
Percentile
8.4
In the wild
Unconfirmed
What it is

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.

This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
2.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
EPSS
0.00192 · 8.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-09-16T14:16Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:28Z
    EPSS moved — → 0%
    epss
  • 16 SEP 09:11Z
    Security Advisory 0170
    cvelistv5