Four OpenSSH Vulnerabilities in Arista Products: Conditions and Response

Advisory overview

Arista published Security Advisory 0147 on August 25, 2026, covering four OpenSSH vulnerabilities across file transfer, server authentication delay and SSH client rekeying. CVE-2026-59995 and CVE-2026-59996 can write files outside the expected location during SFTP or SCP operations. CVE-2026-60001 bypasses sshd's minimum authentication delay. CVE-2026-60002 is a use-after-free in the SSH client when a host key changes during key reexchange.

All four issues affect code before OpenSSH 10.4, but their operational exposure differs. Three require an operator or automation process to initiate an outbound connection to a malicious or compromised server. CVE-2026-60001 instead depends on remote access to the device's SSH service. Inventory client and server roles separately rather than ranking the issues by score alone.

Four attack conditions

CVE-2026-59995 affects SFTP client downloads and may write a file to an unexpected location when the remote server is hostile. CVE-2026-59996 affects SCP remote-to-remote copying and may write into a parent directory. Both require a user-initiated transfer. Restrict transfer roles, use trusted servers and verify the resulting file locations.

CVE-2026-60001 lets an unauthenticated remote actor bypass the minimum delay after failed authentication, accelerating brute-force attempts or username enumeration. It does not by itself authenticate the actor. Use management ACLs, restrict SSH to trusted networks and jump hosts, and prefer public-key authentication. NDR deployments can add external rate limiting.

CVE-2026-60002 has a CVSS score of 9.4 and affects the SSH client when the server host key changes during rekeying. An outbound connection to a malicious or compromised server is required, and the result can include a client crash or code execution. Approved destinations, independent fingerprint verification, strict host-key checking and outbound role limits are the key controls.

Affected products and releases

EOS-based products are common targets for all four CVEs. The advisory lists EOS 4.36.2F and earlier in 4.36, 4.35.5M and earlier in 4.35, 4.34.7M and earlier in 4.34, 4.33.10M and earlier in 4.33, and prior trains. CVE-2026-60001 also maps to platforms including Wi-Fi access points, CVA, DMF, MCD and NDR. CVE-2026-60002 also reaches several Arista management and visibility platforms through their client path.

Do not infer exposure from a product-family name alone. Confirm the exact platform, release and OpenSSH role against the current advisory table. CloudVision as-a-Service, CUE, AGNI, 7130 MOS, NetVisor and VeloCloud appear in Arista's unaffected-product list.

Inventory and exposure review

Build an inventory with product, release, management IP, allowed SSH source networks, password-authentication state, permitted outbound SSH/SFTP/SCP connections and recent transfer owners. Prioritize internet-reachable or broadly reachable management services for CVE-2026-60001. For the client-side issues, review configuration backup, image distribution, support and log-transfer workflows that connect devices to external servers.

Logs and operational evidence

For SFTP and SCP, correlate transfer commands with the actual destination, parent-directory changes and file ownership. For sshd, look for rapid failed authentication, concentration on selected usernames and sources outside the management policy. For the SSH client, review host-key-change warnings, process crashes, relevant core dumps and outbound destinations. Align each event with approved maintenance and transfer records before escalating it.

Upgrade and mitigation

1. Match each product and release to the current Arista SA-0147 table.
2. Restrict management SSH to trusted networks and jump hosts and use key authentication.
3. Allow outbound SSH, SFTP and SCP only to approved servers.
4. Review transfer locations, failed authentication, host-key warnings and core dumps.
5. Upgrade to the product-specific remediated release and retest operational workflows.

A product-specific remediated release is the durable fix. For CVE-2026-60002, Arista identifies EOS 4.35.6M and later and 4.34.8M and later as fixed. Consult the advisory's current Resolution table for every other train and platform. Until the maintenance window, apply the relevant ACL, authentication, trusted-server and strict host-key controls instead of treating one mitigation as a universal answer.

After the upgrade, confirm the active release on each device and test management login, configuration backup, SFTP download, required SCP operations and controller integration with approved endpoints. Verify destination paths and checksums, management ACL behavior, authentication policy and recorded host-key fingerprints. Close the response when the fixed release, reduced exposure, trusted-destination list, evidence review and operational validation are all documented.