CVE-2026-121289
Security Advisory 0208
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
| CWE | CWE-121 |
| Vendor | arista networks |
| Product | eos |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for arista networks eos
Be the first to know when new critical vulnerabilities affecting arista networks eos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Arista Networks / EOS
4.36.0F ≤ 4.36.2F 4.35.0F ≤ 4.35.6M 4.34.0F ≤ 4.34.8M 4.33.0F ≤ 4.33.10M 4.25.1F < 4.33.0F
References
Credits
🔍 This issue was reported to Arista by Joshua Foote of JP Morgan Chase.