On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
In order to be vulnerable to CVE-2026-77190, the following conditions must both be met:
- PIM Sparse Mode must be configured (IPv4 or IPv6). For example:
switch(config)# interface Ethernet1
switch(config-if-Et1)# pim ipv4 sparse-mode
switch# show agent Pimsm uptime
Agent Name Restarts Uptime
<hr />
Pimsm 1 2 days, 14:00:28
or
switch(config)# interface Vlan2
switch(config-if-Vl2)# pim ipv6 sparse-mode
switch# show agent Pimsm6 uptime
Agent Name Restarts Uptime
<hr />
Pimsm6 3 2 days, 14:00:20
- MLAG must be configured and active:
switch(config)# mlag
switch(config-mlag)# local-interface vlan 4094
switch(config-mlag)# peer-address 10.0.0.2
switch(config-mlag)# peer-link port-channel 10
switch(config-mlag)# domain-id mlag1
switch# show mlag
MLAG Configuration:
domain-id : mlag1
local-interface : Vlan4094
peer-address : 10.0.0.2
peer-link : Port-Channel10
MLAG Status:
state : Active
peer-link status : Up
local-int status : Up
system-id : 00:11:22:01:03:01
There is no mitigation or workaround available.
The recommended resolution is to upgrade to a remediated software version at your earliest convenience. Arista recommends customers move to the latest version of each release that contains all the fixes listed below.
CVE-2026-77190 has been fixed in the following releases:
- 4.36.2F and later releases in the 4.36.x train
- 4.35.6M and later releases in the 4.35.x train
- 4.34.8M and later releases in the 4.34.x train
No hotfix is available for this issue.