{"id":"CVE-2026-120980","kind":"vulnerability","aliases":["CVE-2026-120980"],"related":[],"title":"Arista EOS: crafted BGP packet restarts the BGP agent on VPLS routers","description":"On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.","summary":"On Arista EOS with VPLS-BGP enabled, an attacker who already has a BGP session with the provider edge routers can send a crafted BGP packet. That makes the BGP agent restart unexpectedly, disrupting routing.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arista-eos","bgp","infrastructure","network-operators","vpls"],"not_affected_if":["no-untrusted-bgp-peers","vpls-bgp-disabled"],"how_to_check":"- Check whether VPLS-BGP is enabled on Arista EOS devices acting as PE routers.\n- Confirm the running EOS version against the affected ranges in the Arista advisory (unknown from these sources).","fix":null,"status":"open","published_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","triaged_at":"2026-11-10T20:48:12+00:00","updated_at":"2026-11-10T20:48:12+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T20:48:12Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Arista EOS: crafted BGP packet restarts the BGP agent on VPLS routers","impact":"medium","summary":"On Arista EOS with VPLS-BGP enabled, an attacker who already has a BGP session with the provider edge routers can send a crafted BGP packet. That makes the BGP agent restart unexpectedly, disrupting routing.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["arista-eos","vpls","bgp","network-operators"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"BGP agent crashes and restarts, disrupting routing on the device","analyst_note":"Find the affected and fixed EOS versions and the Arista security advisory for CVE-2026-120980; the NVD entry alone does not give them.","how_to_check":"- Check whether VPLS-BGP is enabled on Arista EOS devices acting as PE routers.\n- Confirm the running EOS version against the affected ranges in the Arista advisory (unknown from these sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["vpls-bgp-disabled","no-untrusted-bgp-peers"],"who_is_affected":"Only network operators running Arista EOS PE routers with VPLS-BGP enabled, where an attacker can establish a BGP session with the router. Networks without VPLS-BGP, or without an untrusted BGP peer, are unlikely to be exposed. The sources do not list affected versions or a fixed release.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000744,"input_tokens":4532,"output_tokens":582,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120980':15A,18A '-2026':14A,17A 'affect':65C 'agent':9A,59B,98C 'alreadi':39B 'arista':1A,20B,29B,68C 'arista-eo':19B 'attack':37B,76C 'bgp':4A,8A,22B,34B,42B,53B,58B,73C,81C,92C,97C 'caus':95C 'craft':3A,52B,91C 'cve':13A,16A 'disrupt':62B 'edg':47B 'enabl':35B,74C 'eo':2A,21B,30B,69C 'establish':79C 'infrastructur':23B 'make':56B 'network':25B 'network-oper':24B 'oper':26B 'packet':5A,54B,93C 'pe':85C 'platform':66C 'provid':46B 'restart':6A,60B,100C 'rout':63B 'router':12A,48B,86C 'run':67C 'send':50B,88C 'session':43B,82C 'special':90C 'unexpect':61B,101C 'vpls':11A,27B,33B,72C 'vpls-bgp':32B,71C","nicknames":[],"mitigations":[],"who_affected":"Only network operators running Arista EOS PE routers with VPLS-BGP enabled, where an attacker can establish a BGP session with the router. Networks without VPLS-BGP, or without an untrusted BGP peer, are unlikely to be exposed. The sources do not list affected versions or a fixed release.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aristaeos","bgp","infrastructure","medium","networkoperators","vpls"],"campaign_type":null,"search_a":"'-120980':15A,18A '-2026':14A,17A 'agent':9A 'arista':1A 'bgp':4A,8A 'craft':3A 'cve':13A,16A 'eo':2A 'packet':5A 'restart':6A 'router':12A 'vpls':11A","search_b":"'agent':59B 'alreadi':39B 'arista':20B,29B 'arista-eo':19B 'attack':37B 'bgp':22B,34B,42B,53B,58B 'craft':52B 'disrupt':62B 'edg':47B 'enabl':35B 'eo':21B,30B 'infrastructur':23B 'make':56B 'network':25B 'network-oper':24B 'oper':26B 'packet':54B 'provid':46B 'restart':60B 'rout':63B 'router':48B 'send':50B 'session':43B 'unexpect':61B 'vpls':27B,33B 'vpls-bgp':32B","search_c":"'affect':65C 'agent':98C 'arista':68C 'attack':76C 'bgp':73C,81C,92C,97C 'caus':95C 'craft':91C 'enabl':74C 'eo':69C 'establish':79C 'packet':93C 'pe':85C 'platform':66C 'restart':100C 'router':86C 'run':67C 'send':88C 'session':82C 'special':90C 'unexpect':101C 'vpls':72C 'vpls-bgp':71C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T20:18:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120980","severity":null,"published_at":"2026-11-10T20:18:53+00:00","modified_at":"2026-11-10T20:18:53+00:00","first_seen_at":"2026-11-10T20:46:03+00:00","fetched_at":"2026-11-10T20:46:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}