Arista EOS: BGP process restart via crafted packets in SR-TE address family
Summary
Arista EOS devices running in the multi-agent routing model with the BGP Segment Routing Traffic Engineering (SR-TE) address family configured can be made to restart the BGP process. A BGP peer can trigger this by sending crafted BGP packets, which is a NULL pointer dereference (CWE-476). A successful attack drops all BGP sessions on the device, which affects availability only.
Affected
- Arista EOS 4.22.1F up to but not including 4.32.0F
- Arista EOS 4.32.0F up to but not including 4.33.0F
- Arista EOS 4.33.0F through 4.33.10M
- Arista EOS 4.34.0F through 4.34.8M
- Arista EOS 4.35.0F through 4.35.6M
- Arista EOS 4.36.0F through 4.36.2F
- Condition: multi-agent routing model and BGP SR-TE address family configured
- Ranges taken from the CNA record and mirror sites; verify against the vendor advisory
Fixed in
Unknown. Check the Arista advisory 0213 for fixed releases.
Workaround
Unknown. Contact Arista TAC for mitigation guidance.
Exploitation
No evidence of exploitation in the wild or public proof-of-concept code was found at the time of research.
Our recommendation
- Check whether EOS devices run the multi-agent model with BGP SR-TE configured (show bgp sr-te summary).
- Compare the EOS version with the affected ranges and consult advisory 0213 for fixed releases.
- Restrict BGP peering to known neighbours and filter control-plane traffic from untrusted sources.
- Monitor for unexpected BGP session resets.
- Organisations without this configuration need no immediate action beyond monitoring the vendor advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0213 www.arista.com
- Strix CVE record CVE-2026-121286 www.strix.ai
- ThreatInt CVE record CVE-2026-121286 cve.threatint.com
- Arista EOS sample configurations www.arista.com
- Arista TOI: SR-TE www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:45.
Original description (NVD)
On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.