Arista EOS: Route churn via VPLS-BGP pseudowire advertisements
Summary
Arista EOS with VPLS-BGP enabled is affected. An attacker who has already established a BGP session with the provider edge (PE) router can disturb the route advertisements of VPLS pseudowires. This causes route churn for other legitimate BGP peers, which is an availability impact. The attack requires a valid BGP peering relationship with the device.
Affected
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.36.0F to 4.36.2F
- Only relevant when VPLS-BGP is configured. The default configuration is not affected.
Fixed in
Unknown. Check the Arista advisory for the fixed release.
Workaround
Unknown. No vendor workaround was confirmed in the available sources. Check the Arista advisory.
Exploitation
- No public proof of concept, exploitation report or KEV listing was found at the time of writing.
- The attacker needs low privileges, in practice a valid BGP session with the device.
Our recommendation
- Check whether any Arista EOS device runs VPLS-BGP and compare the EOS version with the affected ranges.
- Read the Arista advisory 25036-security-advisory-0214 and plan an upgrade to a fixed release.
- Until the upgrade is done, limit BGP peering to trusted neighbours.
- Monitor BGP sessions for unexpected route changes and recheck CISA KEV.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0214 (25036) www.arista.com
- CVE Record CVE-2026-120981 www.cve.org
- CVE-2026-120981 mirror (threatint) cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:45.
Original description (NVD)
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.