# CVE-2026-121369: Arista EOS denial of service via resource exhaustion

Source: https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-121369 · Severity: medium · CVSS 5.3 · Published 2026-11-10

Arista EOS is a network operating system for switches and routing equipment. An attacker with direct physical or network connectivity to an affected switch can cause system CPU and memory utilization to spike dramatically, leading to unresponsiveness and eventual system reboot. The attack exploits a configuration weakness on specific switch models and only works when interfaces are set to automatic speed detection.

Technologies: [Arista Eos](https://junglewise.ai/threats/technologies/eos). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-121369 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121369 being exploited in the wild.

**How severe is CVE-2026-121369?** Medium severity, with a CVSS score of 5.3, published 10 November 2026.

**Which products and versions are affected?** Arista CCS-750XM-48TX-LC affected on vulnerable EOS versions; Arista CCS-750XPM-48NH-LC affected on vulnerable EOS versions; Arista CCS-750XPM-48TXH-LC affected on vulnerable EOS versions; Arista Eos 4.36.1M and below (4.36.X train); 4.35.6M and below (4.35.X train); 4.34.2F through 4.34.7M (4.34.X train).

**Is there a fix for CVE-2026-121369?** Yes: fixed in EOS 4.37.0F and later (4.37.X train); 4.36.2M and later (4.36.X train); 4.35.7M and later (4.35.X train); 4.34.7.1M and later (4.34.X train). Until then: Configure explicit speed settings on all interfaces instead of relying on automatic speed negotiation. For example, use the command 'speed auto 1g' on affected interfaces to specify a fixed speed capability, which prevents the resource exhaustion condition.</anigation>
<parameter name="confidence">0.95 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121369 attacked?** It is attacked from the adjacent network or over the network, in a network appliance.

**Am I affected by CVE-2026-121369?** Check whether you run Arista CCS-750XM-48TX-LC, Arista CCS-750XPM-48NH-LC, Arista CCS-750XPM-48TXH-LC or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in EOS 4.37.0F and later (4.37.X train); 4.36.2M and later (4.36.X train); 4.35.7M and later (4.35.X train); 4.34.7.1M and later (4.34.X train)

Configure explicit speed settings on all interfaces instead of relying on automatic speed negotiation. For example, use the command 'speed auto 1g' on affected interfaces to specify a fixed speed capability, which prevents the resource exhaustion condition.</anigation>
<parameter name="confidence">0.95

## Technical details

An uncontrolled resource allocation weakness (CWE-770) in Arista EOS allows the StrataQosV2 or StrataFabric processes to consume excessive CPU and memory on affected switch linecard models (750X series) when interfaces are configured with automatic speed negotiation or default settings. The vulnerability requires direct connectivity to the system and specific configuration conditions; exploitation manifests as sustained high CPU/memory utilization leading to denial of service.

## Affected products

- Arista EOS 4.36.1M and below (4.36.X train); 4.35.6M and below (4.35.X train); 4.34.2F through 4.34.7M (4.34.X train)
- Arista CCS-750XM-48TX-LC affected on vulnerable EOS versions
- Arista CCS-750XPM-48NH-LC affected on vulnerable EOS versions
- Arista CCS-750XPM-48TXH-LC affected on vulnerable EOS versions

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225](https://www.arista.com/en/support/advisories-notices/security-advisory/25047-security-advisory-0225)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS RIPv2 silent enablement on management interfaces](https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information)
- [Arista EOS kernel crash via crafted S-BFD PDU](https://junglewise.ai/threats/cve-2026-121295-on-affected-platforms-running-arista-eos-configured-as-s-bfd)