CVE-2026-75944CWE-459

CVE-2026-75944

Low · published September 15, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
11.4
In the wild
Unconfirmed
What it is

A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User interaction (an AclAgent restart by an administrator) is required for the unintended behavior to take effect.

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
5.6 · CVSS:4.0/AV:A/AC:H/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H
EPSS
0.00216 · 11.4th percentile
Weakness
CWE-459 · Incomplete Cleanup
Published
2026-09-15T03:18Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24706-security-advisory-0150 · [email protected]
EPSS history
Timeline
  • 17 SEP 03:32Z
    EPSS moved — → 0%
    epss
  • 14 SEP 22:19Z
    A race condition during supplicant re-authentication may leave a stale ACL entry that persists in the system. If the AclAgent subsequently restarts, this stale entry may be applied to new supplicants, resulting in incorrect access control enforcement. User
    cvelistv5