CVE-2026-120979: Security Advisory 0212

Published Nov 10, 2026

Updated

This vulnerability affects customers using Arista Pathfinder for WAN path selection with Border Gateway Protocol-Link State (BGP-LS) configured for Dynamic Path Selection (DPS). On affected platforms running Arista EOS with BGP-LS configured for DPS, an attacker who has established an authenticated BGP-LS session with the device can send a specially crafted BGP packet to cause incorrect WAN path selection and disrupt traffic forwarding.

Affected Software

2 affected components

Arista Pathfinder

Arista EOS

Event History

Nov 10, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Exposure is limited to affected platforms running Arista EOS where BGP-LS is configured for Dynamic Path Selection as part of Arista Pathfinder WAN path selection. Systems without that BGP-LS-for-DPS configuration are not identified as affected by the advisory data.

What access does an attacker need to exploit it?

The attacker must first establish an authenticated BGP-LS session with the affected device. The attack is network-reachable and does not require user interaction, but it is not described as exploitable by an unauthenticated peer.

What is the expected impact of successful exploitation?

A crafted BGP packet can cause incorrect WAN path selection and disrupt traffic forwarding. The provided severity vector indicates integrity and availability impact, with no confidentiality impact.

CVE-2026-120979: Security Advisory 0212

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need to exploit it?

What is the expected impact of successful exploitation?