EOS · CVE-2026-121290 · Infrastructure
NO FIX YET
On Arista EOS, changing the BGP listen port from its default value turns off the default access control rules that block unexpected BGP peering attempts. An attacker who can reach the router may be able to establish a BGP peering session it should refuse.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running Arista EOS switches or routers with BGP where the BGP listen port has been changed from the default. Per the NVD description, changing it disables the default protective ACL rules against unexpected BGP peering attempts. Devices without BGP or with the default port can skip it. Affected versions and fix are not yet published in a source we could read.
Not affected if default-bgp-port, no-bgp
Who cares arista-eos, bgp, network-operators
router bgp for a non-default listen portNo fix yet, per the sources.
On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.