How do I check whether I am affected by CVE-2026-121291?

On the switch run 'show bgp rpki cache': exposed only if EOS is 4.37.0F, 4.36.0F-4.36.2F or 4.35.0F-4.35.6M AND an RPKI cache is configured under router bgp with an RPKI-RTR session established. Signs it happened: 'grep "RPKI-4-CACHE_ERROR: Received" /var/log/eos' (Internal Error / No Data Available), 'show bgp rpki cache cache1 counters errors', and a 'Last full sync' time in 'show bgp rpki cache cache1' that no longer advances.

What is the fix for CVE-2026-121291?

Upgrade to EOS 4.36.3M or later (4.36 train) or 4.35.7M or later (4.35 train). No fixed release is named for 4.37.0F in the advisory; check Arista.

Post Share

HIGH8.3CVSS · psirt@arista.com

NO KNOWN
EXPLOIT

EOS · CVE-2026-121291 · Infrastructure

Arista EOS: crafted RPKI Error Report stalls ROA publication and BGP origin validation

Q: Who is not affected by CVE-2026-121291?

Not affected if: no-rpki-configured.

FIX → 4.36.3M +1 ✓ verified

A crafted Error Report can leave EOS stuck believing a cache reset is in progress. While stuck, ROA publication, withdrawal reconciliation and BGP origin-validation updates are blocked.

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

Arista switches and routers running EOS 4.35.0F-4.35.6M, 4.36.0F-4.36.2F or 4.37.0F that use RPKI origin validation with a configured RPKI-RTR cache (including CloudEOS, cEOS-lab, vEOS-lab, CloudVision eXchange). A crafted Error Report from the cache leaves the device believing a cache reset is in progress, blocking ROA updates and origin-validation changes. Skip if you do not use RPKI caches or run EOS before 4.35.0F.

EOS>= 4.35.0F, <= 4.35.6M; >= 4.36.0F, <= 4.36.2F; 4.37.0Ffixed in 4.35.7M, 4.36.3M

Not affected if no-rpki-configured

Who cares arista, bgp, eos, network-devices, routing, rpki

02 · How to check

✓ Verified Nov 10

On the switch run show bgp rpki cache: exposed only if EOS is 4.37.0F, 4.36.0F-4.36.2F or 4.35.0F-4.35.6M AND an RPKI cache is configured under router bgp with an RPKI-RTR session established
Signs it happened: grep "RPKI-4-CACHE_ERROR: Received" /var/log/eos (Internal Error / No Data Available), show bgp rpki cache cache1 counters errors, and a time in that no longer advances

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202620:46 UTCNVD CVE-2026-121291
Nov 10, 202620:56 UTCInfraStack Analyst Arista SA 0222 (read via fetch tool, summarised); NVD lists same versions. Search/X not used. 4.37.0F affected, no fixed 4.37 release stated.

What the sources say, verbatim

177 characters

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

Sources and references

NVD: CVE-2026-121291Nov 10, 2026
Arista Security Advisory 0222Advisory · arista.com

This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next EOS threat the day it hits your stack.

Start free

Post Share

HIGH8.3CVSS · psirt@arista.com

NO KNOWN
EXPLOIT

EOS · CVE-2026-121291 · Infrastructure

Arista EOS: crafted RPKI Error Report stalls ROA publication and BGP origin validation

FIX → 4.36.3M +1 ✓ verified

A crafted Error Report can leave EOS stuck believing a cache reset is in progress. While stuck, ROA publication, withdrawal reconciliation and BGP origin-validation updates are blocked.

first public Nov 10, 2026 · 2 sources

Could this affect your app?

Free first check from your website. Connect your repo for the full answer.

01 · Who is affected

✓ Verified Nov 10

EOS>= 4.35.0F, <= 4.35.6M; >= 4.36.0F, <= 4.36.2F; 4.37.0Ffixed in 4.35.7M, 4.36.3M

Not affected if no-rpki-configured

Who cares arista, bgp, eos, network-devices, routing, rpki

02 · How to check

✓ Verified Nov 10

On the switch run show bgp rpki cache: exposed only if EOS is 4.37.0F, 4.36.0F-4.36.2F or 4.35.0F-4.35.6M AND an RPKI cache is configured under router bgp with an RPKI-RTR session established
Signs it happened: grep "RPKI-4-CACHE_ERROR: Received" /var/log/eos (Internal Error / No Data Available), show bgp rpki cache cache1 counters errors, and a time in that no longer advances

Exploited: No reports yet
Public exploit: None on GitHub
EPSS: Not scored
Last updated: Nov 10, 2026

How it unfolded

2 events · Nov 10, 2026 → Nov 10, 2026

Nov 10, 202620:46 UTCNVD CVE-2026-121291
Nov 10, 202620:56 UTCInfraStack Analyst Arista SA 0222 (read via fetch tool, summarised); NVD lists same versions. Search/X not used. 4.37.0F affected, no fixed 4.37 release stated.

What the sources say, verbatim

177 characters

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

Sources and references

NVD: CVE-2026-121291Nov 10, 2026
Arista Security Advisory 0222Advisory · arista.com

NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.

Check it with your coding agent

It reads this page and tells you if your code is affected.

Claude CodeCodexCursorAdd to your agent

Are you affected?

Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.

InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.

Run the check

Get the next EOS threat the day it hits your stack.

Start free

Arista EOS: crafted RPKI Error Report stalls ROA publication and BGP origin validation

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next EOS threat the day it hits your stack.

Arista EOS: crafted RPKI Error Report stalls ROA publication and BGP origin validation

01 · Who is affected

02 · How to check

How it unfolded

What the sources say, verbatim

Sources and references

Read next

Get the next EOS threat the day it hits your stack.

03 · The fix