CVE-2026-75945
LowCVSS 2.6Summary
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. This may lead to incorrect enforcement of access policy.
Risk Assessment
A supplicant that should have been removed may still have network access, violating security policy. This could enable unauthorized access to network resources.
Recommendation
Update the software to a version containing the fix for this race condition and verify supplicant state after issuing the clear dot1x host all command.
Other vulnerabilities in dot1x
See all- CVE-2026-77191Low
An authenticated supplicant on an adjacent network may bypass the intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of authentication and full enforcement of its assigned ACL.
- CVE-2026-75943Low
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.
Original NVD description (English source)
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued.