ARISTA EOS · CVE-2026-120982 · Infrastructure
FIX → 4.37.0F +4 ✓ verified
On Arista EOS devices with BGP configured, an unauthenticated attacker who can establish a BGP peering session can send crafted BGP messages. These cause repeated BGP session resets, which disrupts routing and traffic forwarding.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Arista EOS switches and routers (7000-series, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange) that run BGP with the multi-agent routing protocol model and a release listed as affected. A peer that can establish a BGP session can send crafted messages that repeatedly reset it. You can skip it if BGP is not configured, the device uses the ribd model, or it is a Wi-Fi AP, CloudVision Portal, DMF, NetVisor or VeloCloud product; Arista lists those as not affected.
Not affected if no-bgp-configured, peering-restricted-to-trusted-peers, routing-model-ribd
Who cares arista-eos, bgp, network-operators
show ip bgp summary ("% BGP is not active" means not exposed) and show running-config all | inc service routing protocols ("model ribd" means not exposed; "model multi-agent" plus BGP means exposed if the version is affected)On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
show version and compare to affected: 4.36.2F and below, 4.35.6M and below, 4.34.8M and below, 4.33.10M and below, and all End of Support trainsUpgrade to 4.37.0F +4
neighbor default received attribute discard 22 (re-enabling attribute 22 on any peer restores exposure); or use TCP-AO peer authentication