Arista EOS: BGP agent crash via crafted packet
Summary
Arista EOS devices with BGP configured can be affected by a flaw that allows a specially crafted packet to crash the BGP agent process. A successful attack terminates the process, which drops all BGP sessions on the device and can disrupt routing until the process recovers. The CVE record also states that a sophisticated attacker might achieve arbitrary code execution, which could compromise confidentiality and integrity; the CVSS vector given is network-reachable without authentication or user interaction.
Affected
- Arista EOS 4.36.0F to 4.36.2F
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.25.1F to below 4.33.0F is not affected by default
- Only devices with BGP configured are relevant.
Fixed in
Unknown. The fixed releases were not confirmed in the available sources; check Arista Security Advisory 0208.
Workaround
- For BGP sessions that do not use the Tunnel Encapsulation Attribute, remove received Tunnel Encapsulation Attributes with: neighbor default received attribute discard 23
- Reduce exposure by configuring BGP peer authentication with TCP-AO so only authorized peers can establish sessions.
Exploitation
Unknown. No reports of exploitation in the wild or public proof-of-concept were found at the time of research.
Our recommendation
- Check whether any Arista EOS device runs BGP and which software release it uses.
- Restrict BGP to known peer addresses and enable TCP-AO or strong neighbour authentication.
- Apply the workaround where Tunnel Encapsulation Attributes are not needed.
- Install the fixed release from Arista Security Advisory 0208 as soon as it is confirmed for your train.
- Monitor BGP session stability and check CISA KEV and NVD for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0208 (CVE-2026-121289) www.arista.com
- Arista Security Advisories index www.arista.com
- Arista EOS BGP manual www.arista.com
- Arista BGP peering best practices arista.my.site.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 21:22.
Original description (NVD)
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.