Quick answers
- Is CVE-2026-121290 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-121290 being exploited in the wild.
- How severe is CVE-2026-121290?
- High severity, with a CVSS score of 8.2, published 10 November 2026.
- Which products and versions are affected?
- Arista Eos 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x; all End of Support releases.
- Is there a fix for CVE-2026-121290?
- Yes: fixed in EOS 4.36.3 and later (4.36.x train); 4.35.7M and later (4.35.x train); 4.34.9M and later (4.34.x train); 4.33.11M and later (4.33.x train). Until then: If operationally feasible, remove the non-default BGP listen port configuration to restore ACL protection on the default port 179. If a non-default port must be retained, manually configure control plane ACLs to restrict incoming connections to only expected remote IP addresses and apply TTL-based filtering if applicable. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-121290 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-121290?
- Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: EOS 4.36.3 and later (4.36.x train); 4.35.7M and later (4.35.x train); 4.34.9M and later (4.34.x train); 4.33.11M and later (4.33.x train)
If operationally feasible, remove the non-default BGP listen port configuration to restore ACL protection on the default port 179. If a non-default port must be retained, manually configure control plane ACLs to restrict incoming connections to only expected remote IP addresses and apply TTL-based filtering if applicable.
Technical details
When BGP is configured with a non-default listen port and multi-agent routing model is enabled, default Access Control List (ACL) rules that restrict BGP connections to expected sources are bypassed. An attacker with network access can send unexpected BGP traffic to the custom port, bypassing GTSM (Generalized TTL Security Mechanism) protections and enabling BGP hijacking or denial-of-service attacks. This is a configuration-dependent vulnerability requiring both a non-default listen port and multi-agent model to be exploited.
Affected products
- Arista EOS 4.36.2F and below (4.36.x); 4.35.6M and below (4.35.x); 4.34.8M and below (4.34.x); 4.33.10M and below (4.33.x); all 4.32.x; all End of Support releases
Timeline
- 2026-11-10: disclosed