CVE-2026-19640

On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions. This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170

Configurations

No configuration.

History

No history.

Information

Published : 2026-09-16 10:16

Updated : 2026-09-16 11:16

NVD link : CVE-2026-19640

Mitre link : CVE-2026-19640

CVE.ORG link : CVE-2026-19640

JSON object : View

Products Affected

No product.

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-19640", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "psirt@arista.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "psirt@arista.com", "affectedData": [{"vendor": "Arista Networks", "product": "EOS", "versions": [{"status": "affected", "version": "4.36.0F", "versionType": "custom", "lessThanOrEqual": "4.36.0.1F"}, {"status": "affected", "version": "4.35.0F", "versionType": "custom", "lessThanOrEqual": "4.35.5M"}, {"status": "affected", "version": "4.34.0F", "versionType": "custom", "lessThanOrEqual": "4.34.7M"}, {"status": "affected", "version": "4.33.0F", "versionType": "custom", "lessThanOrEqual": "4.33.8M"}, {"status": "affected", "version": "4.24.0F", "lessThan": "4.33.0F", "versionType": "custom"}], "platforms": ["710 Series", "720D Series", "720XP/722XPM Series", "750X Series", "7010TX Series", "7020R/R4 Series", "7130 Series running EOS", "7170 Series", "7050X3/X4 Series", "7060X/X2/X4/X5/X6 Series", "7260X/X3 Series", "7280R/R2/R3/R4 Series", "7300X/X3 Series", "7320X Series", "7358X4 Series", "7368X4 Series", "7388X5 Series", "7500R/R2/R3 Series", "7800R3/R4 Series", "7700R4 Series", "AWE 5000 Series", "AWE 7200R Series", "CloudEOS", "cEOS-lab", "vEOS-lab", "CloudVision eXchange, virtual or physical appliance"], "defaultStatus": "unaffected"}]}], "published": "2026-09-16T10:16:50.943", "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24726-security-advisory-0170", "source": "psirt@arista.com"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "psirt@arista.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incorrect authorization results, potentially allowing access beyond their currently assigned permissions.\n\nThis issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks."}], "lastModified": "2026-09-16T11:16:41.590", "sourceIdentifier": "psirt@arista.com"}