Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-121289 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-10 |
| Vendor | Arista |
| Product | EOS |
| Vulnerability Type | stack-based buffer overflow (CWE-121) |
| CVSS Score | 9.8 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.
Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
Required Actions
- Update Arista EOS to the fixed version listed in the vendor’s Security Advisory 0208 (which also covers workarounds and affected platforms).
- Restrict access to the BGP port (179/TCP) to defined neighbors only — using control-plane ACLs and edge filtering.
- Where possible, enable BGP session authentication (TCP-AO / MD5) and GTSM.
- Monitor BGP agent restarts and sudden session drops — they may indicate exploitation attempts.
Who Is Affected?
The vulnerability affects Arista switches and routers running EOS with BGP configured — typically in data centers, service provider networks and large enterprise networks. The Arista advisory lists the affected platforms and versions.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-121289 vulnerability?
CVE-2026-121289 is a stack-based buffer overflow (CWE-121) in the BGP agent of Arista EOS that lets a crafted packet crash the BGP process and potentially execute code. CVSS score: 9.8.
Does exploiting CVE-2026-121289 require authentication?
According to the vendor's CVSS assessment, the attack is carried out over the network and requires no authentication. The device must have BGP configured.
How to protect against CVE-2026-121289?
Update EOS as per Arista Security Advisory 0208 and restrict access to the BGP port to trusted neighbors.
Who is affected by CVE-2026-121289?
Organizations running Arista devices with EOS and BGP enabled — data centers, service providers and large enterprise networks.
