Arista EOS: Denial of service via S-BFD reflector proxy
Summary
Arista EOS on affected switches with an S-BFD reflector proxy configured can be disrupted by an unauthenticated attacker. A crafted S-BFD Protocol Data Unit can cause the device to temporarily stop reflecting S-BFD packets, which may lead to S-BFD session timeouts. The issue only applies when the reflector proxy is configured; it affects availability and does not allow code execution or data theft.
Affected
- Arista EOS 4.36.0F to 4.36.2F
- Arista EOS 4.35.0F to 4.35.6M
- Arista EOS 4.34.0F to 4.34.8M
- Arista EOS 4.33.0F to 4.33.10M
- Arista EOS 4.32.0F to before 4.33.0F
- Arista EOS 4.29.0F to before 4.32.0F
- Arista EOS 4.28.2F to before 4.29.0F
- Condition: S-BFD reflector proxy configured (reflector local-discriminator with proxy)
- Exact ranges to be verified against Arista Security Advisory 0223.
Fixed in
Unknown. Please take the fixed versions from Arista Security Advisory 0223.
Workaround
Unknown. No vendor or third-party workaround has been identified. Check whether the S-BFD reflector proxy is configured at all; the issue only applies in that configuration.
Exploitation
- No evidence of exploitation in the wild found.
- Not listed in CISA KEV according to a third-party tracker.
- No public proof of concept found.
Our recommendation
- Check whether any Arista switch runs S-BFD with the reflector proxy configured.
- Inventory EOS versions and compare them with Arista Security Advisory 0223.
- Plan patching together with CVE-2026-121295, which is in the same advisory and rated higher.
- Restrict S-BFD reachability to internal or carrier-side networks; do not expose it to the internet.
- Re-check NVD and the Arista advisory after a few days, as the data is still changing.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0223 www.arista.com
- Vulners: ARISTA:0223 vulners.com
- Strix: CVE-2026-121294 www.strix.ai
- threatint: CVE-2026-121294 cve.threatint.com
- Arista EOS 4.29.0F Documentation www.arista.com
- Arista Advisories and Notices www.arista.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 09:58.
Original description (NVD)
On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.