CVE WatchJul 22, 2026

CVE-2024-6858

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capa

CVSS

6.5

Medium

EPSS

0.1%

KEV

—

Exploit Today

0-100

Published: Jun 4, 2026 · Last modified: Jul 22, 2026 · CWE-1287

EPSS · 30d

0.1%EPSS · 30 days0.1%

2026-06-302026-07-26

Technical description

In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN.

Official references

www.arista.comhttps://www.arista.com/en/support/advisories-notices/security-advisory/19917-security-advisory-0103

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-47738.1 HIG

24.3%

——7Improper validation of specified type of input vulnerability in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This issue affects IDM-MFA: from 2025.11.27 before 2026.03.10.5d CVE-2026-505247.5 HIG

46.7%

——14Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network.5d CVE-2026-450699.1 CRI

14.8%

——4Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to 6.4.40, 7.4.12, and 8.0.12, OidcTokenHandler::verifyClaims() registered audience (aud), issuer (iss), and expiry (exp) checkers but did not pass the mandatory claims list to ClaimCheckerManager::check(), so a validly signed JWT that omitted those claims could pass verification. This issue is fixed in versions 6.4.40, 7.4.12, and 8.0.12.13d CVE-2026-551245.5 MED

30.8%

——9Improper validation of specified type of input in Microsoft Office Word allows an unauthorized attacker to disclose information locally.12d CVE-2026-449359.9 CRI

33.8%

——10Missing validation of "valuesFrom" references in Helm Deployer of SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 could be used by owners of one tenant to access fleet credentials of other tenants.22d CVE-2026-442498.1 HIG

43.9%

——13Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue.5d