Is CVE-2026-121287 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121287 being exploited in the wild.

How severe is CVE-2026-121287?

High severity, with a CVSS score of 8.8, published 10 November 2026.

Which products and versions are affected?

Arista Eos 4.37.0F and below; 4.36.2F and below in 4.36.x; 4.35.6M and below in 4.35.x; 4.34.8M and below in 4.34.x; 4.33.10M and below in 4.33.x; all 4.32.x releases; all End of Support trains.

How is CVE-2026-121287 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-121287?

Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121287: Arista EOS RIPv2 buffer underflow and authentication bypass

CVE-2026-121287 · Severity: high · CVSS 8.8 · Published 2026-11-10

Arista EOS network switches use the Routing Information Protocol (RIPv2) to manage routing tables. An attacker on the same network segment can send specially crafted packets to crash the routing service or inject forged routing updates, disrupting network traffic for the affected device and others that depend on it. In the worst case, this could allow arbitrary code execution on the switch.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-121287 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121287 being exploited in the wild.
How severe is CVE-2026-121287?: High severity, with a CVSS score of 8.8, published 10 November 2026.
Which products and versions are affected?: Arista Eos 4.37.0F and below; 4.36.2F and below in 4.36.x; 4.35.6M and below in 4.35.x; 4.34.8M and below in 4.34.x; 4.33.10M and below in 4.33.x; all 4.32.x releases; all End of Support trains.
Is there a fix for CVE-2026-121287?: No fixed version is recorded yet. Disable RIP or configure strict RIP authentication on interfaces not requiring it. Restrict network access to RIP-enabled interfaces through access control lists. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121287 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-121287?: Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Disable RIP or configure strict RIP authentication on interfaces not requiring it. Restrict network access to RIP-enabled interfaces through access control lists.

Technical details

Two vulnerabilities exist in RIPv2 MD5 authentication on Arista EOS: CVE-2026-121287 is a buffer underflow in RIP packet handling that crashes the Rip agent when a malformed RIPv2 packet is sent to a RIP-enabled interface, and CVE-2026-121288 allows bypass of MD5 authentication to inject unauthorized route updates. Both require adjacent network access, RIP enabled, and MD5 authentication configured on the interface; no user interaction or authentication is required.

Affected products

Arista EOS 4.37.0F and below; 4.36.2F and below in 4.36.x; 4.35.6M and below in 4.35.x; 4.34.8M and below in 4.34.x; 4.33.10M and below in 4.33.x; all 4.32.x releases; all End of Support trains

Timeline

2026-11-10: disclosed

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25043-security-advisory-0221

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.