CVE-2026-121371

CVSS 8.7 (high) · published 2026-11-10

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

Weakness: CWE-22

Source: NVD CVE-2026-121371

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/25040-security-advisory-0218

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.