CVE-2026-77190CWE-20

CVE-2026-77190

Medium · published September 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
19.5
In the wild
Unconfirmed
What it is

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
6.0 · CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L
EPSS
0.00281 · 19.5th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-09-16T14:16Z
References (1)
EPSS history
Timeline
  • 18 SEP 04:01Z
    EPSS moved — → 0%
    epss
  • 16 SEP 10:08Z
    Security Advisory 0177
    cvelistv5