{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 205 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25027-security-advisory-0205"
      }
    ],
    "title": "Security Advisory 205",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:17Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 205",
      "initial_release_date": "2026-11-08T09:58:17Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:17Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.1",
                    "product": {
                      "name": "EOS version 4.36.1",
                      "product_id": "CSAFPID-1"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.2",
                    "product": {
                      "name": "EOS version 4.36.2",
                      "product_id": "CSAFPID-0"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-120975",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "2047420"
      },
      "notes": [
        {
          "category": "description",
          "text": "On affected platforms running Arista EOS with automatic certificate management configured and automatic Certificate Authority (CA) certificate retrieval enabled, a malicious packet may cause the AutoCertMgmt process to be terminated unexpectedly. Managed X.509 certificates will not be renewed automatically and may eventually expire, potentially disrupting TLS-dependent services.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-120975, the following condition must be met:\n\nAutomatic certificate management must be configured with automatic CA certificate retrieval enabled:\n```\n#show running-config section auto-certificate\nmanagement security\n   auto-certificate profile cert1\n      key clientkey.pem\n      parameters distinguished-name common-name \"arista\"\n      protocol instance est1\n   auto-certificate protocol est est1\n      server url https://example.com\n      server ca-certificate auto-update\n      server ca-certificate validation fingerprint sha2-256 <...>\n```\n\nIf automatic certificate management is not configured or if automatic CA certificate retrieval is not enabled, there is no exposure to the issue and the output will either be empty or contain SSL profile usage instead:\n```\n#show running-config section auto-certificate\nmanagement security\n   auto-certificate profile cert1\n      key clientkey.pem\n      parameters distinguished-name common-name \"arista\"\n      protocol instance est1\n   auto-certificate protocol est est1\n      server url https://example.com\n      server ssl profile ssl1\n```",
          "title": "2047420: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-1"
        ],
        "fixed": [
          "CSAFPID-0"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120975"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.2",
          "product_ids": [
            "CSAFPID-0"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 4.36.1",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "mitigation",
          "details": "The workaround for the issue is to disable automatic CA certificate retrieval under the auto-certificate protocol and instead use manually distributed CA certificates under an SSL profile. The following CLI commands will disable CA auto update to ensure that data for the certificate retrieval will only come from trusted servers:\n\n```\n(config-mgmt-sec-auto-cert-proto-est-est1)# no server ca-certificate auto-update\n(config-mgmt-sec-auto-cert-proto-est-est1)# server url https://example.com\n(config-mgmt-sec-auto-cert-proto-est-est1)# server ssl profile ssl1\n```\n\nFor more information about configuring automatic certificate management see EOS User Manual: Automatic Certificate Management."
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-0"
          ]
        }
      ],
      "title": "CVE-2026-120975"
    }
  ]
}