CVE-2026-77191
LowCVSS 2.6Summary
An authenticated supplicant on an adjacent network may bypass the intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of authentication and full enforcement of its assigned ACL.
Risk Assessment
During this brief window, traffic may pass without ACL enforcement, potentially allowing unauthorized access to network resources. The risk is time-limited but can be exploited by an attacker on the local network.
Recommendation
Apply vendor patches that eliminate the timing gap between authentication and ACL enforcement, and monitor for unusual network traffic.
Other vulnerabilities in dot1x
See all- CVE-2026-75945Low
A race condition may cause a supplicant to remain in an authorized state after a clear dot1x host all command is issued. This may lead to incorrect enforcement of access policy.
- CVE-2026-75943Low
A brief (milliseconds to seconds) traffic leak may occur when an authenticated supplicant is removed, either via the clear dot1x host all CLI command or due to a supplicant timeout. During this window, the supplicant's traffic may pass without ACL enforcement.
Original NVD description (English source)
An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (milliseconds to seconds) between the completion of the authentication phase and the full enforcement of its assigned ACL.