CVE-2026-77190

Executive Summary

CVE-2026-77190 is a malformed-input denial-of-service vulnerability (CWE-20) in the Arista EOS PIM Sparse Mode (Pimsm) agent affecting switches configured with both PIM Sparse Mode and MLAG. An unauthenticated, network-adjacent attacker can send crafted malformed messages that cause the Pimsm agent to terminate unexpectedly, and repeated delivery forces continuous agent restarts, producing a sustained denial of service. With a CVSS base score of 6.5 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), the flaw is trivially triggerable from an adjacent network segment but impacts availability only, degrading multicast routing services on affected switches.

Technical Analysis

The vulnerability resides in the Pimsm agent — the process responsible for Protocol Independent Multicast Sparse Mode operations on Arista EOS. The NVD description states that an unauthenticated attacker who is network-adjacent to the switch and can connect to a device with both PIM Sparse Mode and MLAG configured can "send malformed messages that cause the Pimsm agent to terminate unexpectedly." The underlying weakness is classified as CWE-20 (Improper Input Validation), meaning the Pimsm agent fails to adequately validate the structure or contents of inbound PIM-related messages before processing them, leading to an unhandled fault and process termination.

The attack surface is the network-reachable multicast control plane. PIM Sparse Mode relies on control messages exchanged between multicast routers; these messages must be accepted from adjacent network peers for correct protocol operation, which is precisely what exposes the Pimsm agent to malformed input from an unauthenticated source. MLAG (Multi-Chassis Link Aggregation) configuration is a stated precondition, indicating the fault path or code surface is reached only in the MLAG topology context.

Two aspects of the impact are explicitly documented: (1) the Pimsm agent terminates unexpectedly, and (2) the agent is automatically restarted by the system supervisor. The restart mechanism, normally a resilience feature, becomes the amplification vector: repeated malformed messages keep the agent in a crash-restart loop, resulting in "a sustained denial of service." No specific message types, field names, or code functions are disclosed in the available description, and no patch, workaround, or affected-version enumeration has been published in the tracked sources.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class (CWE-20 input-validation failure causing agent termination) and the NVD description.

1. Reconnaissance / target identification. The attacker must first obtain a position network-adjacent to an Arista EOS switch. Candidate targets are identified by detecting switches that present EOS management interfaces and, ideally, by observing PIM Sparse Mode control-plane traffic on the adjacent segment. Because exploitation requires PIM Sparse Mode and MLAG to be configured, the attacker seeks segments where multicast routing (PIM-SM) is active and MLAG peers or member links are present. Shodan-style fingerprinting of exposed EOS devices (product:"Arista EOS") can shortlist internet- or WAN-adjacent candidates, though the AV:A vector means the practical attack surface is the local/adjacent network.

2. Triggering the flaw. Working from the adjacent segment, the attacker transmits malformed messages toward the switch's PIM control plane. The malformation exploits the absent/insufficient input validation in the Pimsm agent — the crafted message is accepted at the network layer but is not safely parsed, causing an unhandled fault. Per the advisory, the agent then "terminate[s] unexpectedly."

3. Execution method (class level). This is a remote, unauthenticated, packet-level attack requiring no credentials (PR:N) and no user interaction (UI:N). The attack complexity is low (AC:L): the malformed-message format, once known, can be replayed deterministically. No specific message type, protocol field, or packet structure is documented, so no payload template can be reproduced here.

4. Post-exploitation impact. The supervisor automatically restarts the Pimsm agent. The attacker repeats the malformed-message transmission, forcing a crash-restart loop — "repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service." The effect is loss of multicast routing on the affected device for the duration of the attack; there is no described confidentiality or integrity impact, and no code execution, credential theft, or lateral movement is indicated.

Impact Assessment

The CVSS 3.1 base score of 6.5 reflects the following subscores:

• Attack Vector (AV:A — Adjacent): exploitation is confined to a network-adjacent attacker, not arbitrary internet hosts. This meaningfully narrows the population of potential attackers to those with a foothold on an adjacent segment (e.g., a compromised host in the same Layer 2/3 domain, a partner interconnect, or a misconfigured VLAN boundary).
• Attack Complexity (AC:L — Low): no special conditions beyond the presence of PIM-SM + MLAG configuration; repeated triggering is straightforward.
• Privileges Required (PR:N): no authentication required.
• User Interaction (UI:N): no user action needed.
• Scope (S:U — Unchanged): the impact remains within the vulnerable component.
• Confidentiality (C:N) / Integrity (I:N): no data exposure or modification described.
• Availability (A:H — High): total loss of the Pimsm agent's availability, sustained through continuous restarts.

Business impact: Affected switches lose multicast routing capability. Environments dependent on multicast — market-data distribution, IPTV, video conferencing, industrial/multicast telemetry, and data-center overlay signaling — will experience service interruption on the affected device. Because the attacker is adjacent and unauthenticated, an internal foothold or a partner-facing segment is sufficient to mount the attack. Blast radius is bounded to multicast routing on configured devices rather than a full switch outage, but sustained Pimsm instability may cascade to dependent multicast receivers. There is no evidence of CISA KEV listing, active exploitation, or public exploit availability at this time, so risk is currently assessed as conditional on the attacker achieving adjacency.

Detection Guidance

Sigma Rule

title: Arista EOS Pimsm Agent Repeated Crash-Restart (CVE-2026-77190)
id: 8f3c1a2e-7719-4d90-9b21-cve202677190
status: experimental
description: Detects repeated Pimsm agent termination/restart events on Arista EOS switches with PIM Sparse Mode and MLAG, consistent with CVE-2026-77190 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-77190
author: valtersit.com
date: 2026/07/01
logsource:
  product: arista
  service: eos
detection:
  selection_agent:
    message|contains:
      - 'Pimsm'
  selection_event:
    message|contains:
      - 'restart'
      - 'terminat'
      - 'unexpected'
      - 'core dump'
  condition: selection_agent and selection_event
  timeframe: 10m
falsepositives:
  - Planned Pimsm process maintenance or controlled reloads
  - Single, non-recurring agent restart (benign supervisor action)
level: high
tags:
  - attack.t1498
  - cve.2026.77190

YARA Rule

rule CVE_2026_77190_Arista_Pimsm_Crash
{
    meta:
        description = "Detects Arista EOS Pimsm agent crash artifacts related to CVE-2026-77190 malformed message handling"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-77190"
        date = "2026-07-01"
        cve = "CVE-2026-77190"

    strings:
        $pimsm   = "Pimsm" ascii wide nocase
        $eos     = "Arista EOS" ascii wide nocase
        $fault1  = "unexpectedly" ascii wide nocase
        $fault2  = "SIGSEGV" ascii wide
        $fault3  = "SIGABRT" ascii wide
        $fault4  = "core dump" ascii wide nocase

    condition:
        uint32(0) == 0x464C457F and
        filesize < 200MB and
        $pimsm and
        (
            any of ($fault*)
        )
}

Suricata IDS Rule

alert udp any any -> $HOME_NET 103 (msg:"CVE-2026-77190 Arista EOS PIM Sparse Mode malformed message DoS attempt"; flow:to_server; content:"|20|"; depth:1; byte_test:1,>,15,0,relative; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-dos; sid:9007719; rev:1; metadata:created_at 2026_07_01, cve CVE-2026-77190, affected_product Arista_EOS;)

alert ip any any -> $HOME_NET any (msg:"CVE-2026-77190 Repeated PIM control-plane malformed packets toward MLAG switch"; flow:to_server; dsize:<128; threshold:type both, track by_src, count 50, seconds 30; classtype:attempted-dos; sid:9007720; rev:1; metadata:created_at 2026_07_01, cve CVE-2026-77190;)

Note: the destination port 103 (PIM) above is a standard protocol constant; the malformed-message pattern is generic because the advisory does not disclose the exact malformed structure. Tuning against local traffic baselines is required.

Elastic Detection

sequence by host.name with maxspan=5m
  [ any where process.name : "Pimsm" ]
  [ any where process.name : "Pimsm" and event.category : "process" and
    (event.action : ("terminated" or "crashed" or "core_dump") or
     message : ("*restart*" or "*terminat*" or "*unexpected*")) ]

Splunk SPL Query

index=network sourcetype=arista:eos "Pimsm"
| search "restart" OR "terminat" OR "unexpected" OR "core dump"
| bucket _time span=10m
| stats count as crash_events dc(host) as affected_hosts values(message) as messages by host, _time
| where crash_events >= 3
| sort - crash_events
| table _time, host, crash_events, affected_hosts, messages

Wazuh OSSEC Rule

<group name="arista,eos,cve-2026-77190,">
  <rule id="100719" level="12">
    <decoded_as>json</decoded_as>
    <field name="program">Pimsm</field>
    <match>restart|terminat|unexpected|core dump</match>
    <description>CVE-2026-77190: Arista EOS Pimsm agent terminated/restarted unexpectedly - possible malformed PIM Sparse Mode DoS</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>cve_2026_77190,denial_of_service,</group>
  </rule>

  <rule id="100720" level="14" frequency="3" timeframe="600">
    <if_matched_sid>100719</if_matched_sid>
    <same_source_ip />
    <description>CVE-2026-77190: Repeated Pimsm agent crashes (3+ in 10m) - sustained multicast DoS on MLAG switch</description>
    <mitre>
      <id>T1498</id>
    </mitre>
    <group>cve_2026_77190,denial_of_service,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, affected-version list, or patch reference has been disclosed in the tracked intelligence. The following measures should be treated as compensating controls until Arista publishes remediation.

1) Immediate mitigations

• Where PIM Sparse Mode is not operationally required on MLAG-configured switches, disable it to remove the exposed attack surface. This is the most reliable near-term control because the vulnerability requires both PIM-SM and MLAG to be present.
• Restrict Layer 2/3 adjacency to the switch's PIM control plane using multicast control-plane policing (CoPP), ACLs, and PIM neighbor authentication / TTL-scoping, so that only trusted, expected multicast routers can reach the Pimsm agent. Reduce the adjacent attacker population as far as topology permits.
• Segment management and control-plane traffic onto dedicated, least-privilege VLANs so that an adjacent compromise does not expose PIM control messaging.
• Monitor the Pimsm agent's restart frequency and alert on abnormal crash-restart loops (see Detection Guidance).

2) Patch / upgrade steps

• No patched version is currently identified. Once Arista publishes an EOS software release addressing CVE-2026-77190, upgrade affected switches during a maintenance window and verify the Pimsm agent's stability post-upgrade. Subscribe to Arista security advisories to obtain the authoritative fixed release and version matrix.
• Track the NVD entry and Arista advisory for updates to affected-version ranges and patch availability.

3) Long-term hardening

• Enforce strict multicast control-plane filtering as a standing configuration baseline, limiting which peers can source PIM control messages to the switch.
• Maintain configuration/hardening review cycles for PIM-SM and MLAG topologies, validating that both are enabled only where required.
• Integrate agent-crash telemetry (Pimsm process restart events) into SIEM continuous monitoring to detect future repeated-crash DoS patterns.
• Establish a patch-response process that tracks vendor advisories for networking gear with defined SLAs, given the historical latency of network-OS security releases.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-77190
• Arista Security Advisories portal: https://www.arista.com/en/support/advisories-notices (consult for the authoritative advisory and fixed EOS release)
• FIRST EPSS: not yet scored for CVE-2026-77190 (https://www.first.org/epss)
• CISA Known Exploited Vulnerabilities catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-77190 is NOT listed as of this report)
• MITRE ATT&CK T1498 (Network Denial of Service): https://attack.mitre.org/techniques/T1498/

Threat actor / exploit-in-the-wild status: No public PoC, no exploit code, no Nuclei template, and no CISA KEV listing exist for CVE-2026-77190 as of this report. No threat actor campaigns are associated with this CVE in the available data. Detection guidance above is based on the documented behavior (Pimsm agent crash-restart) and the CWE-20 vulnerability class; network signatures are generic and require local tuning.