---
id: "CVE-2026-121290"
page: "https://infrastack.ai/live/CVE-2026-121290"
kind: "vulnerability"
aliases: ["CVE-2026-121290"]
title: "Arista EOS: changing BGP listen port disables default peering protection ACLs"
severity: "high"
cvss: 8.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "EOS", "fixed": [], "affected": "unknown, see Arista advisory", "ecosystem": "vendor"}]
ecosystems: []
tags: ["arista-eos", "bgp", "infrastructure", "network-operators"]
not_affected_if: ["default-bgp-port", "no-bgp"]
published_at: "2026-11-10T20:18:54+00:00"
first_seen_at: "2026-11-10T20:46:03+00:00"
updated_at: "2026-11-10T20:56:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121290", "first_seen_at": "2026-11-10T20:46:03+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-10T20:56:29+00:00"}]
exploit_sources: []
---

# Arista EOS: changing BGP listen port disables default peering protection ACLs

Link for people: https://infrastack.ai/live/CVE-2026-121290 (this .md is for agents)

On Arista EOS, changing the BGP listen port from its default value turns off the default access control rules that block unexpected BGP peering attempts. An attacker who can reach the router may be able to establish a BGP peering session it should refuse.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EOS affected unknown, see Arista advisory fixed no fixed version listed

## How to check

Exposed only if EOS runs BGP with the BGP listen port changed from its default. Look in the running config under 'router bgp' for a non-default listen port. Affected and fixed EOS versions are unknown until Arista's advisory is published; check the Arista security advisories page for this CVE.

## Timeline

- 2026-11-10T20:46:03+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121290
- 2026-11-10T20:56:29+00:00 analyst — Arista's own advisory for this CVE is not indexed yet (published today); only the NVD description (CNA psirt@arista.com) was found. No versions or fix read, so none stated. Revisit when the advisory appears on arista.com/en/support/advisories-notices.

## From the sources

On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_