Is CVE-2026-121289 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121289 being exploited in the wild.

How severe is CVE-2026-121289?

Critical severity, with a CVSS score of 9.8, published 10 November 2026.

Which products and versions are affected?

Arista Eos 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), all 4.25.1F through 4.32.x (End of Support trains).

How is CVE-2026-121289 attacked?

It is attacked over the network.

Am I affected by CVE-2026-121289?

Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121289: Arista EOS BGP agent crash via crafted packet

CVE-2026-121289 · Severity: critical · CVSS 9.8 · Published 2026-11-10

Arista EOS is network routing software that manages Border Gateway Protocol (BGP) traffic on switches. A specially crafted network packet can crash the BGP agent process, causing all BGP sessions to drop and disrupting network routing. An attacker with network access could potentially achieve arbitrary code execution on the affected device, compromising its security and integrity.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-121289 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121289 being exploited in the wild.
How severe is CVE-2026-121289?: Critical severity, with a CVSS score of 9.8, published 10 November 2026.
Which products and versions are affected?: Arista Eos 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), all 4.25.1F through 4.32.x (End of Support trains).
Is there a fix for CVE-2026-121289?: Yes: fixed in 4.37.0F and later (4.37.x train), 4.36.3M and later (4.36.x train), 4.35.7M and later (4.35.x train). Until then: Disable reception of Tunnel Encapsulation Attributes via 'neighbor default received attribute discard 23', or configure BGP peer authentication using TCP-AO to restrict BGP sessions to authorized peers only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121289 attacked?: It is attacked over the network.
Am I affected by CVE-2026-121289?: Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.37.0F and later (4.37.x train), 4.36.3M and later (4.36.x train), 4.35.7M and later (4.35.x train)

Disable reception of Tunnel Encapsulation Attributes via 'neighbor default received attribute discard 23', or configure BGP peer authentication using TCP-AO to restrict BGP sessions to authorized peers only.

Technical details

A stack-based buffer overflow (CWE-121) in the BGP agent allows a network attacker to send a crafted packet that crashes the BGP process or potentially executes arbitrary code. The vulnerability requires BGP to be configured with the multi-agent routing protocol model enabled. No authentication or user interaction is required, and the attack vector is network-based with low complexity.

Affected products

Arista EOS 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), all 4.25.1F through 4.32.x (End of Support trains)

Timeline

2026-11-10: disclosed

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25030-security-advisory-0208

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.