CVE-2026-121293

Security Advisory 0210

On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121370

Security Advisory 0224

On affected platforms running Arista EOS with Precision Time Protocol (PTP) configured, an unauthenticated attacker with network access to a PTP-enabled port can create a denial of service (DoS) condition by sending traffic to the system.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121371

Security Advisory 0218

On affected EOS versions with the eAPI service enabled, a specially crafted HTTP request can allow an unauthenticated, remote attacker to read arbitrary files, including sensitive credentials from the switch filesystem.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120976

Security Advisory 0216

On affected platforms running Arista EOS with IEEE 802.1X authentication and MACsec using dynamically derived keys, sensitive authentication information may be recorded in diagnostic data during a Smart Switch Upgrade (SSU). An attacker with administrative access on the device who obtains the affected diagnostic data could recover sensitive authentication information. This could potentially compromise the confidentiality and integrity of traffic protected by MACsec on the affected link. The vulnerability is only exposed during and after an SSU reload where an active 802.1X session used for MACsec is present.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120978

Security Advisory 0211

On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121369

Security Advisory 0225

On affected platforms running Arista EOS under specific link configurations an attacker with direct connectivity to the system may cause system CPU and memory utilization to increase considerably leading to slow responsiveness and eventually may cause the system to reboot.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121287

Security Advisory 0221

An unauthenticated attacker on an adjacent network segment can send crafted RIPv2 packets to a RIP-enabled interface on the device to trigger the Rip agent crash without providing valid credentials. Repeated exploitation reliably interrupts routing service on the affected device, which may also disrupt routing for other devices that depend on it. In a worst-case scenario, the vulnerability may allow an attacker to execute arbitrary code on the affected device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121290

Security Advisory 0209

On affected platforms running Arista EOS with Border Gateway Protocol (BGP) changing the BGP listen port from its default value disables default protective Access Control List (ACL) rules against unexpected BGP peering attempts.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121291

Security Advisory 0222

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121367

Security Advisory 0220

On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication. Successful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121368

Security Advisory 0206

On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120979

Security Advisory 0212

This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120980

Security Advisory 0214

On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE routers can send a specially crafted BGP packet to cause the BGP agent to restart unexpectedly.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120981

Security Advisory 0214

On affected platforms running Arista EOS with VPLS-BGP enabled, an attacker who has established a BGP session with the PE router can affect the route advertisements of VPLS pseudowires, causing a churn of the established routes with other legitimate BGP peers.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120982

Security Advisory 0207

On affected platforms running Arista EOS with Border Gateway Protocol (BGP) configured, An unauthenticated attacker who can establish a BGP peering session with an affected device and can send specially crafted BGP messages to cause repeated BGP session resets, enabling sustained disruption to network routing and traffic forwarding.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-120983

Security Advisory 0215

On affected EOS platforms where 802.1x is configured in multi-host authenticated mode and the device is configured with Policy Based Routing (PBR), traffic from unauthenticated hosts may be forwarded to the destination configured in the PBR policies. This could potentially allow unauthenticated hosts access to networks. Additionally Layer 2 and Layer 3 control packets from unauthenticated hosts may get copied to the CPU.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121286

Security Advisory 0213

On affected platforms running Arista EOS in multi-agent routing model with BGP Segment Routing Traffic Engineering (SR-TE) address family configured, a BGP peer can send crafted BGP packets to cause the BGP process to restart, disrupting all BGP sessions on the device.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121288

Security Advisory 0221

An unauthenticated attacker on an adjacent network segment can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Successful exploitation requires that RIPv2 MD5 authentication is configured on the affected interface. An attacker who can inject crafted RIPv2 packets could cause the device to install routes that redirect network traffic through attacker-controlled paths, create routing loops, or blackhole traffic, disrupting network connectivity.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121289

Security Advisory 0208

On affected platforms running Arista EOS with BGP configured, a specially crafted packet can cause the BGP agent to crash. Successful exploitation causes the BGP agent process to terminate, resulting in the loss of all BGP sessions on the affected device and possible disruption to network routing until the process recovers. Due to the nature of the vulnerability, it may also be possible for a sophisticated attacker to achieve arbitrary code execution, which could compromise the confidentiality and integrity of the affected system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-121292

Security Advisory 0222

A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos