EOS · CVE-2026-121289 · Infrastructure
FIX → 4.37.0F +4 ✓ verified
Arista Security Advisory 0208: on EOS with BGP configured and the multi-agent routing protocol model in use, a specially crafted packet can crash the BGP agent (stack-based buffer overflow, CWE-121), dropping all BGP sessions. Arista says a sophisticated attacker may also achieve arbitrary code execution; that is stated as possible, not demonstrated. Reported by Joshua Foote of JP Morgan Chase; Arista is not aware of malicious exploitation.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Arista EOS switches and routers (7000-series families, CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange) running BGP with the multi-agent routing protocol model, on 4.36.2F and below, 4.35.6M and below, 4.34.8M and below, 4.33.10M and below, and all end-of-support trains from 4.25.1F. Devices without BGP, or on the ribd model, are not exposed. Wi-Fi APs, CloudVision Portal, NetVisor, VeloCloud and other listed products are not affected.
Not affected if no-bgp-configured, ribd-routing-model
Who cares arista-eos, bgp, network-infrastructure, self-hosted
Exposed only if BOTH hold: BGP is running (show ip bgp summary does not say '% BGP is not running') AND show running-config all | inc service routing protocols returns 'service routing protocols model multi-agent' (model ribd = not exposed). Then compare show version with the affected list. IoC: from bash, or the ProcMgr 'Bgp ... status=-11 has terminated' line in show logging.
On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash.
Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
grep "PROCESS_TERMINATED: 'Bgp'" /var/log/eosUpgrade to 4.37.0F +4
neighbor default received attribute discard 23