CVE-2026-121294: Security Advisory 0223

Published Nov 10, 2026

Updated

On affected platforms running Arista EOS with a S-BFD reflector proxy configured, an unauthenticated attacker could send a crafted S-BFD Protocol Data Unit (PDU) that might cause the device to temporarily cease reflecting S-BFD packets, potentially resulting in S-BFD session timeouts.

Affected Software

1 affected component

Arista EOS

Event History

Nov 10, 2026

CVE Published

via MITRE·08:09 PM

Data Sourced

via MITRE·08:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

Affected platforms running Arista EOS are exposed only when an S-BFD reflector proxy is configured.

What does an attacker need to exploit it?

An unauthenticated attacker needs network access sufficient to send a crafted S-BFD Protocol Data Unit to the affected device. No user interaction or privileges are required.

What is the operational impact of a successful attack?

The device may temporarily stop reflecting S-BFD packets, which can cause S-BFD sessions to time out. The provided information identifies an availability impact and does not identify confidentiality or integrity impact.

CVE-2026-121294: Security Advisory 0223

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the operational impact of a successful attack?