CVE-2026-120978: Security Advisory 0211

Published Nov 10, 2026

Updated

On affected Arista EOS platforms running Border Gateway Protocol with Link State ( BGP-LS) and configured with the Dynamic Path Selection (DPS) consumer role, an attacker who has established an authenticated BGP-LS session with the device can send a crafted message to cause the BGP agent to restart unexpectedly. An Arista Pathfinder deployment is not required.

Affected Software

1 affected component

Arista EOS

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Security Advisory 0211

Event History

Nov 10, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Arista EOS platforms are exposed when they run BGP-LS and are configured with the Dynamic Path Selection consumer role. A Pathfinder deployment is not required.

What access does an attacker need to trigger the restart?

The attacker must first establish an authenticated BGP-LS session with the affected device. They can then send a crafted message that causes the BGP agent to restart unexpectedly.

What is the operational impact of successful exploitation?

Successful exploitation causes an unexpected restart of the BGP agent, resulting in an availability impact. The provided data does not indicate confidentiality or integrity impact.

CVE-2026-120978: Security Advisory 0211

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to trigger the restart?

What is the operational impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to trigger the restart?

What is the operational impact of successful exploitation?