# CVE-2026-121293: Arista EOS BGP denial of service in Dynamic Path Selection

Source: https://junglewise.ai/threats/cve-2026-121293-on-affected-eos-based-platforms-an-attacker-who-controls-a  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-121293 · Severity: medium · CVSS 4.4 · Published 2026-11-10

Arista EOS, which powers enterprise network switches and routing platforms, contains a flaw in its BGP (Border Gateway Protocol) implementation that can be exploited by an attacker with network access to a BGP peer. A malicious BGP message can crash the BGP routing process, disrupting all network routing until the service restarts and potentially causing significant network outages. The attacker must have control of an established BGP peer relationship configured with Dynamic Path Selection.

Technologies: [Arista cEOS-lab](https://junglewise.ai/threats/technologies/ceos-lab), [Arista CloudEOS](https://junglewise.ai/threats/technologies/cloudeos), [Arista Eos](https://junglewise.ai/threats/technologies/eos), [Arista vEOS-lab](https://junglewise.ai/threats/technologies/veos-lab). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-121293 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121293 being exploited in the wild.

**How severe is CVE-2026-121293?** Medium severity, with a CVSS score of 4.4, published 10 November 2026.

**Which products and versions are affected?** Arista cEOS-lab affected versions same as EOS; Arista CloudEOS affected versions same as EOS; Arista Eos 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), all 4.32.x, all End of Support trains; Arista vEOS-lab affected versions same as EOS.

**Is there a fix for CVE-2026-121293?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121293 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-121293?** Check whether you run Arista cEOS-lab, Arista CloudEOS, Arista Eos or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A null pointer dereference in the EOS BGP process occurs when a crafted BGP message is received over an established session with the Dynamic Path Selection (DPS) address family negotiated. The vulnerability requires the attacker to control a BGP peer and have an active DPS-negotiated session; exploitation causes the BGP process to crash (SIGSEGV or SIGABRT), resetting all BGP sessions and disrupting routing. Patched versions are available.

## Affected products

- Arista EOS 4.36.2F and below (4.36.x), 4.35.6M and below (4.35.x), 4.34.8M and below (4.34.x), 4.33.10M and below (4.33.x), all 4.32.x, all End of Support trains
- Arista CloudEOS affected versions same as EOS
- Arista cEOS-lab affected versions same as EOS
- Arista vEOS-lab affected versions same as EOS

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210](https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS RIPv2 silent enablement on management interfaces](https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information)