{"id":"CVE-2026-120979","kind":"vulnerability","aliases":["CVE-2026-120979"],"related":[],"title":"Arista Pathfinder: crafted BGP-LS packet disrupts WAN path selection","description":"This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding.","summary":"An attacker with an authenticated BGP-LS session to an Arista EOS device configured for Dynamic Path Selection can send a crafted BGP packet. This causes incorrect WAN path selection and disrupts traffic forwarding.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"eos","fixed":["4.37.0F","4.36.3M","4.35.7M","4.34.9M","4.33.11M"],"affected":"<= 4.36.2F, <= 4.35.6M, <= 4.34.8M, <= 4.33.10M, all 4.32.x","ecosystem":"vendor"}],"ecosystems":[],"tags":["arista","awe","bgp-ls","cloudeos","eos","infrastructure","network","pathfinder","wan"],"not_affected_if":["fixed-eos-version","no-bgp-ls-dps","no-bgp-ls-peer","no-pathfinder","not-pathfinder-role"],"how_to_check":"Exposed only if all are true: (1) EOS version is 4.36.2F or lower in 4.36.x, 4.35.6M or lower in 4.35.x, 4.34.8M or lower in 4.34.x, 4.33.10M or lower in 4.33.x, any 4.32.x, or an End-of-Support train; (2) 'show bgp link-state summary' shows at least one BGP-LS peer in Estab state; (3) 'show adaptive-virtual-topology path | section Role:' prints 'Role: pathfinder'. If BGP-LS is not configured, no peer is established, or the role is edge, zone transit, region transit or unknown, the device is not affected. Signs of abuse: unexpected active-path changes or a high rate of SFE-6-PATH_ACTIVE / SFE-6-PATH_INACTIVE syslog messages ('show logging | include SFE-6-PATH_ACTIVE|SFE-6-PATH_INACTIVE'). Arista states there are no configuration-level mitigations that fully resolve this without upgrading.","fix":"Upgrade EOS to 4.37.0F or later, 4.36.3M, 4.35.7M, 4.34.9M or 4.33.11M (or later in the same train). No hotfix. 4.32.x and End-of-Support trains have no listed fix, so move to a fixed train.","status":"open","published_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:47:39+00:00","updated_at":"2026-11-10T21:00:19+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-11-10T20:47:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista Pathfinder: crafted BGP-LS packet disrupts WAN path selection","impact":"medium","summary":"An attacker with an authenticated BGP-LS session to an Arista EOS device configured for Dynamic Path Selection can send a crafted BGP packet. This causes incorrect WAN path selection and disrupts traffic forwarding.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista","eos","pathfinder","bgp-ls","wan","network"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Traffic forwarding disrupted through incorrect WAN path selection","analyst_note":"Find the Arista security advisory for CVE-2026-120979 to list affected and fixed EOS versions and any workaround.","how_to_check":"- Check whether the device runs Arista EOS with BGP-LS configured for Dynamic Path Selection (DPS) in Pathfinder WAN deployments.\n- Confirm the EOS version against the affected ranges in the Arista advisory, which the sources do not list.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-bgp-ls-dps","no-pathfinder"],"who_is_affected":"Customers using Arista Pathfinder for WAN path selection with BGP-LS configured for Dynamic Path Selection on Arista EOS. The attacker must already hold an authenticated BGP-LS session with the device, so networks without BGP-LS DPS can skip it. The sources do not list affected EOS versions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000759,"input_tokens":4606,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Arista security advisory for CVE-2026-120979 to list affected and fixed EOS versions and any workaround.","search":"'-120979':14A,17A '-2026':13A,16A 'affect':67C,93C 'arista':1A,19B,41B,70C,96C 'attack':31B,106C 'authent':34B,111C 'awe':20B 'bgp':5A,22B,36B,53B,84C,100C,113C,124C 'bgp-ls':4A,21B,35B,83C,99C,112C 'border':77C 'caus':56B,127C 'cloudeo':24B 'configur':44B,86C,102C 'craft':3A,52B,123C 'custom':68C 'cve':12A,15A 'devic':43B,118C 'disrupt':8A,62B,133C 'dps':91C,104C 'dynam':46B,88C 'eo':25B,42B,97C 'eos':18A 'establish':109C 'forward':64B,135C 'gateway':78C 'incorrect':57B,128C 'infrastructur':26B 'link':81C 'ls':6A,23B,37B,85C,101C,114C 'network':27B 'packet':7A,54B,125C 'path':10A,47B,59B,74C,89C,130C 'pathfind':2A,28B,71C 'platform':94C 'protocol':80C 'protocol-link':79C 'run':95C 'select':11A,48B,60B,75C,90C,131C 'send':50B,120C 'session':38B,115C 'special':122C 'state':82C 'traffic':63B,134C 'use':69C 'vulner':66C 'wan':9A,29B,58B,73C,129C","nicknames":[],"mitigations":[],"who_affected":"Arista says only AWE 5000 Series, AWE 7200R Series and CloudEOS are affected, and only when configured as a Pathfinder node with an established BGP-LS peer session. An attacker with an authenticated BGP-LS session can send a crafted BGP packet that causes incorrect WAN path selection and disrupts forwarding. Teams without Pathfinder/BGP-LS, and Arista's listed switch series, CloudVision, VeloCloud and Wi-Fi products, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T21:00:19Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","run_id":2734},"products":{"at":"2026-11-10T21:00:19Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","run_id":2734},"mitigations":{"at":"2026-11-10T21:00:19Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","run_id":2734},"how_to_check":{"at":"2026-11-10T21:00:19Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","run_id":2734},"who_affected":{"at":"2026-11-10T21:00:19Z","by":"analyst","doc":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","run_id":2734}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["eos"],"ptokens":["eos"],"labels":["arista","awe","bgpls","cloudeos","eos","high","infrastructure","network","pathfinder","wan"],"campaign_type":null,"search_a":"'-120979':14A,17A '-2026':13A,16A 'arista':1A 'bgp':5A 'bgp-ls':4A 'craft':3A 'cve':12A,15A 'disrupt':8A 'eos':18A 'ls':6A 'packet':7A 'path':10A 'pathfind':2A 'select':11A 'wan':9A","search_b":"'arista':19B,41B 'attack':31B 'authent':34B 'awe':20B 'bgp':22B,36B,53B 'bgp-ls':21B,35B 'caus':56B 'cloudeo':24B 'configur':44B 'craft':52B 'devic':43B 'disrupt':62B 'dynam':46B 'eo':25B,42B 'forward':64B 'incorrect':57B 'infrastructur':26B 'ls':23B,37B 'network':27B 'packet':54B 'path':47B,59B 'pathfind':28B 'select':48B,60B 'send':50B 'session':38B 'traffic':63B 'wan':29B,58B","search_c":"'affect':67C,93C 'arista':70C,96C 'attack':106C 'authent':111C 'bgp':84C,100C,113C,124C 'bgp-ls':83C,99C,112C 'border':77C 'caus':127C 'configur':86C,102C 'craft':123C 'custom':68C 'devic':118C 'disrupt':133C 'dps':91C,104C 'dynam':88C 'eo':97C 'establish':109C 'forward':135C 'gateway':78C 'incorrect':128C 'link':81C 'ls':85C,101C,114C 'packet':125C 'path':74C,89C,130C 'pathfind':71C 'platform':94C 'protocol':80C 'protocol-link':79C 'run':95C 'select':75C,90C,131C 'send':120C 'session':115C 'special':122C 'state':82C 'traffic':134C 'use':69C 'vulner':66C 'wan':73C,129C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120979","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120979","severity":null,"published_at":"2026-11-10T20:18:53+00:00","modified_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120979:2734","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","severity":null,"published_at":"2026-11-10T21:00:19+00:00","modified_at":"2026-11-10T21:00:19+00:00","first_seen_at":"2026-11-10T21:00:19+00:00","fetched_at":"2026-11-10T21:00:19+00:00","note":"Read Arista Security Advisory 0212 (vendor, Nov 10 2026): affected/fixed EOS versions, exact check commands, no mitigation, no hotfix. Not exploited per Arista; no PoC. Social search skipped (new advisory, no CVE-id posts expected).","cites":["https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212"]}],"documents":[{"id":118467,"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25034-security-advisory-0212","title":"Arista Security Advisory 0212","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}