CVE-2026-121291: Security Advisory 0222

Published Nov 10, 2026

Updated

A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

Affected Software

1 affected component

Arista EOS

Event History

Nov 10, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What must an attacker be able to send to trigger the condition?

An attacker must be able to deliver a crafted Error Report to the affected EOS system. No privileges or user interaction are required according to the provided severity vector.

What operational functions are disrupted if exploitation succeeds?

EOS can remain stuck believing a cache reset is in progress. This prevents ROA publication, withdrawal reconciliation, and BGP origin-validation updates.

What is the practical security impact?

The issue affects integrity and availability, with no confidentiality impact indicated. Stale or unreconciled origin-validation state may persist because BGP origin-validation updates cannot be processed.

CVE-2026-121291: Security Advisory 0222

Affected Software

Event History

Frequently Asked Questions

What must an attacker be able to send to trigger the condition?

What operational functions are disrupted if exploitation succeeds?

What is the practical security impact?

Company

Resources

Contact

Frequently Asked Questions

What must an attacker be able to send to trigger the condition?

What operational functions are disrupted if exploitation succeeds?

What is the practical security impact?