CVE-2026-120980 · Infrastructure
NO FIX YET
On Arista EOS with VPLS-BGP enabled, an attacker who already has a BGP session with the provider edge routers can send a crafted BGP packet. That makes the BGP agent restart unexpectedly, disrupting routing.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only network operators running Arista EOS PE routers with VPLS-BGP enabled, where an attacker can establish a BGP session with the router. Networks without VPLS-BGP, or without an untrusted BGP peer, are unlikely to be exposed. The sources do not list affected versions or a fixed release.
Not affected if no-untrusted-bgp-peers, vpls-bgp-disabled
Who cares arista-eos, bgp, network-operators, vpls
No fix yet, per the sources.
On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.