Quick answers
- Is CVE-2026-120979 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120979 being exploited in the wild.
- How severe is CVE-2026-120979?
- High severity, with a CVSS score of 8.1, published 10 November 2026.
- Which products and versions are affected?
- Arista Eos 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x.
- Is there a fix for CVE-2026-120979?
- Yes: fixed in EOS 4.36.3F and later (4.36.x), 4.35.7M and later (4.35.x), 4.34.9M and later (4.34.x), 4.33.11M and later (4.33.x). Until then: Disable BGP-LS or do not establish BGP-LS peer sessions until patching is completed. Restrict BGP-LS peer access to trusted sources only. Monitor syslog for unexpected PATH_ACTIVE or PATH_INACTIVE messages indicating path selection changes without configuration changes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-120979 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-120979?
- Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: EOS 4.36.3F and later (4.36.x), 4.35.7M and later (4.35.x), 4.34.9M and later (4.34.x), 4.33.11M and later (4.33.x)
Disable BGP-LS or do not establish BGP-LS peer sessions until patching is completed. Restrict BGP-LS peer access to trusted sources only. Monitor syslog for unexpected PATH_ACTIVE or PATH_INACTIVE messages indicating path selection changes without configuration changes.
Technical details
The vulnerability is an improper input validation issue (CWE-1289) in BGP-LS packet handling for Pathfinder nodes using Dynamic Path Selection. An attacker with an authenticated BGP-LS session can craft a malicious BGP packet to cause incorrect path selection. Exploitation requires BGP-LS configuration, an established BGP-LS peer session, and Pathfinder node role; unpatched versions of EOS 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), and all 4.32.x releases are affected.
Affected products
- Arista EOS 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x
Timeline
- 2026-11-10: disclosed