Is CVE-2026-121292 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121292 being exploited in the wild.

How severe is CVE-2026-121292?

High severity, with a CVSS score of 8.2, published 10 November 2026.

Which products and versions are affected?

Arista Eos 4.37.0F, 4.36.2F and below in 4.36.x train, 4.35.6M and below in 4.35.x train, 4.34.8M and below in 4.34.x train, 4.33.10M and below in 4.33.x train, all releases in End of Support trains beginning with 4.24.0F; releases before 4.24.0F are not affected.

How is CVE-2026-121292 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-121292?

Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121292: Arista EOS out-of-bounds read in RPKI Error Report handling

CVE-2026-121292 · Severity: high · CVSS 8.2 · Published 2026-11-10

Arista EOS is a network operating system used in switches and routers for enterprise networks. A malformed RPKI (Resource Public Key Infrastructure) message from an external cache can cause the RPKI agent to crash or leak sensitive memory contents in logs. An attacker controlling or intercepting RPKI cache traffic could exploit this to disrupt BGP route validation or expose system information.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-121292 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121292 being exploited in the wild.
How severe is CVE-2026-121292?: High severity, with a CVSS score of 8.2, published 10 November 2026.
Which products and versions are affected?: Arista Eos 4.37.0F, 4.36.2F and below in 4.36.x train, 4.35.6M and below in 4.35.x train, 4.34.8M and below in 4.34.x train, 4.33.10M and below in 4.33.x train, all releases in End of Support trains beginning with 4.24.0F; releases before 4.24.0F are not affected.
Is there a fix for CVE-2026-121292?: No fixed version is recorded yet. Operators should verify RPKI cache connectivity is not configured by running 'show bgp rpki cache' on affected devices. If RPKI is not in use, these vulnerabilities cannot be exploited through the RPKI protocol. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-121292 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-121292?: Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Operators should verify RPKI cache connectivity is not configured by running 'show bgp rpki cache' on affected devices. If RPKI is not in use, these vulnerabilities cannot be exploited through the RPKI protocol.

Technical details

CVE-2026-121292 is an out-of-bounds read (CWE-125) in EOS's RPKI client triggered by a crafted Error Report message. The vulnerability allows an attacker controlling the RPKI cache or positioned to intercept RPKI-to-Router (RPKI-RTR) protocol traffic to cause the RPKI agent to read beyond packet boundaries, resulting in either termination of the agent or disclosure of unintended memory contents through logging. Exploitation requires RPKI cache connectivity to be configured on the target device.

Affected products

Arista EOS 4.37.0F, 4.36.2F and below in 4.36.x train, 4.35.6M and below in 4.35.x train, 4.34.8M and below in 4.34.x train, 4.33.10M and below in 4.33.x train, all releases in End of Support trains beginning with 4.24.0F; releases before 4.24.0F are not affected

Timeline

2026-11-10: disclosed

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.