Arista EOS: Denial of service through repeated BGP session resets
Summary
Arista EOS devices with Border Gateway Protocol (BGP) configured are affected. An unauthenticated attacker who can establish a BGP peering session with the device and send specially crafted BGP messages can cause repeated BGP session resets. This leads to sustained disruption of routing and traffic forwarding. Exposure is low unless TCP port 179 is reachable from untrusted networks.
Affected
- EOS 4.36.0F to 4.36.2F
- EOS 4.35.0F to 4.35.6M
- EOS 4.34.0F to 4.34.8M
- EOS 4.33.0F to 4.33.10M
- EOS 1.0.0 to before 4.33.0F
- Only relevant where BGP is configured.
Fixed in
Unknown. The vendor advisory has not been confirmed as of this entry. Do not assume any version is fixed.
Workaround
- Apply globally: router bgp <asn> and neighbor default received attribute discard 22. Re-enable the attribute on specific peers only where required.
- Alternatively, configure BGP peer authentication with TCP-AO so that only authorised peers can establish a session.
- Limit BGP sessions to known peer addresses and filter TCP 179 to expected peers only.
Exploitation
- No evidence of exploitation in the wild found.
- One aggregator lists the CVE as not in the CISA KEV catalogue. This is not an authoritative check.
- No public proof of concept known.
Our recommendation
- Check whether Arista EOS devices with BGP are in use, and in which versions.
- Apply the vendor's fix as soon as it is published; monitor the Arista advisory 25029 for it.
- Until then, apply the discard-22 workaround or TCP-AO, and restrict TCP 179 to known peers.
- Prioritise internet-facing and partner-facing BGP devices.
- Monitor BGP session flaps and routing changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record CVE-2026-120982 www.cve.org
- Arista Security Advisory 0207 www.arista.com
- Arista EOS BGP documentation www.arista.com
- Aggregator entry CVE-2026-120982 www.strix.ai
- CVE mirror with references CVE-2026-120982 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:03.
Original description (NVD)
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.