Is CVE-2026-121367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121367 being exploited in the wild.

How severe is CVE-2026-121367?

Critical severity, with a CVSS score of 9.6, published 10 November 2026.

Which products and versions are affected?

Arista Eos 4.37.0F, 4.36.2F and below in 4.36.x, 4.35.6M and below in 4.35.x, 4.34.8M and below in 4.34.x, 4.33.10M and below in 4.33.x, all 4.32.x, all End of Support releases.

How is CVE-2026-121367 attacked?

It is attacked from the adjacent network, in a network appliance.

Am I affected by CVE-2026-121367?

Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121367: Arista EOS RIPv2 silent enablement on management interfaces

CVE-2026-121367 · Severity: critical · CVSS 9.6 · Published 2026-11-10

Arista EOS network switches with RIPv2 routing protocol configured can silently enable RIPv2 on their management interfaces despite administrator intent to disable it. An attacker on the adjacent network can send crafted routing advertisements to inject malicious routes, allowing them to redirect network traffic, black-hole legitimate connections, or disrupt overall network reachability for traffic passing through affected devices.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-121367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121367 being exploited in the wild.
How severe is CVE-2026-121367?: Critical severity, with a CVSS score of 9.6, published 10 November 2026.
Which products and versions are affected?: Arista Eos 4.37.0F, 4.36.2F and below in 4.36.x, 4.35.6M and below in 4.35.x, 4.34.8M and below in 4.34.x, 4.33.10M and below in 4.33.x, all 4.32.x, all End of Support releases.
Is there a fix for CVE-2026-121367?: Yes: fixed in 4.36.3M and later. Until then: Disable RIP within affected VRF instances if not required, ensuring alternate routing is confirmed before making changes. If RIP is needed on data interfaces, verify that no RIP network prefix matches the management subnet by reviewing configuration and testing route behavior.</anigation> <parameter name="timeline">[ {"kind": "disclosed", "at": "2026-11-10"} ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121367 attacked?: It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-121367?: Check whether you run Arista Eos at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 4.36.3M and later

Disable RIP within affected VRF instances if not required, ensuring alternate routing is confirmed before making changes. If RIP is needed on data interfaces, verify that no RIP network prefix matches the management subnet by reviewing configuration and testing route behavior.</anigation> <parameter name="timeline">[ {"kind": "disclosed", "at": "2026-11-10"} ]

Technical details

When RIPv2 is enabled and a RIP network prefix matches a management interface subnet in the same VRF, the protocol may be unexpectedly activated on that management interface even if not explicitly configured there. An unauthenticated, adjacent-network attacker can send crafted RIPv2 route advertisements to the management IP address; the device accepts and installs these routes without authentication, leading to traffic manipulation or blackholing.

Affected products

Arista EOS 4.37.0F, 4.36.2F and below in 4.36.x, 4.35.6M and below in 4.35.x, 4.34.8M and below in 4.34.x, 4.33.10M and below in 4.33.x, all 4.32.x, all End of Support releases

References

https://www.arista.com/en/support/advisories-notices/security-advisory/25042-security-advisory-0220

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.