# CVE-2026-120979: Arista EOS improper validation in BGP-LS path selection

Source: https://junglewise.ai/threats/cve-2026-120979-this-vulnerability-affects-customers-using-arista-pathfinder-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120979 · Severity: high · CVSS 8.1 · Published 2026-11-10

Arista EOS is used for WAN edge routing and path selection. When BGP-LS (Border Gateway Protocol-Link State) is configured for dynamic path selection, an authenticated attacker can send a specially crafted BGP packet to disrupt traffic forwarding and redirect WAN traffic to incorrect paths, potentially causing network outages or data exposure.

Technologies: [Arista Eos](https://junglewise.ai/threats/technologies/eos). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-120979 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120979 being exploited in the wild.

**How severe is CVE-2026-120979?** High severity, with a CVSS score of 8.1, published 10 November 2026.

**Which products and versions are affected?** Arista Eos 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x.

**Is there a fix for CVE-2026-120979?** Yes: fixed in EOS 4.36.3F and later (4.36.x), 4.35.7M and later (4.35.x), 4.34.9M and later (4.34.x), 4.33.11M and later (4.33.x). Until then: Disable BGP-LS or do not establish BGP-LS peer sessions until patching is completed. Restrict BGP-LS peer access to trusted sources only. Monitor syslog for unexpected PATH_ACTIVE or PATH_INACTIVE messages indicating path selection changes without configuration changes. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120979 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-120979?** Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in EOS 4.36.3F and later (4.36.x), 4.35.7M and later (4.35.x), 4.34.9M and later (4.34.x), 4.33.11M and later (4.33.x)

Disable BGP-LS or do not establish BGP-LS peer sessions until patching is completed. Restrict BGP-LS peer access to trusted sources only. Monitor syslog for unexpected PATH_ACTIVE or PATH_INACTIVE messages indicating path selection changes without configuration changes.

## Technical details

The vulnerability is an improper input validation issue (CWE-1289) in BGP-LS packet handling for Pathfinder nodes using Dynamic Path Selection. An attacker with an authenticated BGP-LS session can craft a malicious BGP packet to cause incorrect path selection. Exploitation requires BGP-LS configuration, an established BGP-LS peer session, and Pathfinder node role; unpatched versions of EOS 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), and all 4.32.x releases are affected.

## Affected products

- Arista EOS 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212](https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS RIPv2 silent enablement on management interfaces](https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information)