{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 216 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25038-security-advisory-0216"
      }
    ],
    "title": "Security Advisory 216",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:17Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 216",
      "initial_release_date": "2026-11-08T09:58:17Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:17Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 4.35.7",
                    "product": {
                      "name": "EOS version 4.35.7",
                      "product_id": "CSAFPID-2"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.22.0",
                    "product": {
                      "name": "EOS version 4.22.0",
                      "product_id": "CSAFPID-0"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.3",
                    "product": {
                      "name": "EOS version 4.36.3",
                      "product_id": "CSAFPID-5"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.37.0",
                    "product": {
                      "name": "EOS version 4.37.0",
                      "product_id": "CSAFPID-4"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.33.10",
                    "product": {
                      "name": "EOS version 4.33.10",
                      "product_id": "CSAFPID-3"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.34.9",
                    "product": {
                      "name": "EOS version 4.34.9",
                      "product_id": "CSAFPID-1"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-120976",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1899357"
      },
      "notes": [
        {
          "category": "description",
          "text": "On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU).\n\nAn attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link.\n\nThe vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-120976, the following condition must be met:\n* For the MACsec key exposure described in this advisory, a device must meet all of these following configuration conditions:\n* IEEE 802.1X authentication is configured on the affected interface.\n\nA MACsec profile containing key source dot1x is applied to that same interface, enabling MACsec to derive keys from successful 802.1X authentication.\n\n1.) 802.1X configuration\n```\nswitch#show running-config section dot1x\ndot1x system-auth-control\n!\ninterface Ethernet1\n   dot1x pae authenticator\n   dot1x port-control auto\n```\n\n2.) MACsec configuration\n```\nswitch#show running-config section mac security\nmac security\n   profile macsecDot1xProfile\n      key source dot1x\n!\ninterface Ethernet1\n   mac security profile macsecDot1xProfile\n```",
          "title": "1899357: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-0"
        ],
        "fixed": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-120976"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.10",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.37.0",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 4.22.0",
          "product_ids": [
            "CSAFPID-0"
          ]
        },
        {
          "category": "mitigation",
          "details": "There is no mitigation possible for this vulnerability."
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-0",
            "CSAFPID-5",
            "CSAFPID-3",
            "CSAFPID-2",
            "CSAFPID-4"
          ]
        }
      ],
      "title": "CVE-2026-120976"
    }
  ]
}