CVE-2026-120982: Arista EOS BGP session reset denial of service

CVE-2026-120982 · Severity: high · CVSS 7.5 · Published 2026-11-10

Arista EOS, a network operating system used in data center switches and routing equipment, suffers from a denial-of-service vulnerability in its Border Gateway Protocol (BGP) implementation. An attacker who can establish a BGP peering session can send specially crafted messages to repeatedly reset BGP sessions, disrupting network routing and causing traffic forwarding failures until the device is patched or mitigations are applied.

Technologies: Arista cEOS-lab, Arista CloudEOS, Arista Eos, Arista vEOS-lab. Vendors: Arista.

Quick answers

Is CVE-2026-120982 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-120982 being exploited in the wild.
How severe is CVE-2026-120982?
High severity, with a CVSS score of 7.5, published 10 November 2026.
Which products and versions are affected?
Arista cEOS-lab affected versions not separately specified; Arista CloudEOS affected versions not separately specified; Arista CloudVision eXchange affected versions not separately specified; Arista Eos 4.36.2F and below (4.36.x train); 4.35.6M and below (4.35.x train); 4.34.8M and below (4.34.x train); 4.33.10M and below (4.33.x train); all End of Support release trains; and 1 more.
Is there a fix for CVE-2026-120982?
Yes: fixed in EOS 4.36.3F and above (4.36.x train); 4.35.7M and above (4.35.x train); 4.34.9M and above (4.34.x train); 4.33.11M and above (4.33.x train). Until then: Configure attribute discard on affected BGP instances using `router bgp <asn> neighbor default received attribute discard 22` to discard the malformed attribute globally, or selectively per peer. Alternatively, configure BGP peer authentication using TCP-AO to restrict BGP session establishment to authorized peers only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-120982 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-120982?
Check whether you run Arista cEOS-lab, Arista CloudEOS, Arista CloudVision eXchange or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: EOS 4.36.3F and above (4.36.x train); 4.35.7M and above (4.35.x train); 4.34.9M and above (4.34.x train); 4.33.11M and above (4.33.x train)

Configure attribute discard on affected BGP instances using `router bgp <asn> neighbor default received attribute discard 22` to discard the malformed attribute globally, or selectively per peer. Alternatively, configure BGP peer authentication using TCP-AO to restrict BGP session establishment to authorized peers only.

Technical details

The vulnerability exists in EOS's BGP message processing when the multi-agent routing protocol model is active. An unauthenticated attacker with network access and the ability to establish a BGP peer session can send specially crafted BGP UPDATE messages that violate protocol expectations, triggering notification errors and session resets. This causes sustained availability impact through routing disruption; no authentication or user interaction is required beyond BGP peering capability.

Affected products

  • Arista EOS 4.36.2F and below (4.36.x train); 4.35.6M and below (4.35.x train); 4.34.8M and below (4.34.x train); 4.33.10M and below (4.33.x train); all End of Support release trains
  • Arista CloudEOS affected versions not separately specified
  • Arista cEOS-lab affected versions not separately specified
  • Arista vEOS-lab affected versions not separately specified
  • Arista CloudVision eXchange affected versions not separately specified

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.