CVE-2026-121368: Security Advisory 0206

Published Nov 10, 2026

Updated

On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.

Affected Software

1 affected component

Arista EOS

Event History

Nov 10, 2026

CVE Published

via MITRE·08:10 PM

Data Sourced

via MITRE·08:10 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Affected Arista EOS platforms are exposed when BFD is enabled on an interface and configured to use keyed MD5 or keyed SHA1 authentication. The attacker must have direct or multi-hop network adjacency to that BFD-enabled interface.

Does exploitation require credentials or user interaction?

No. The issue can be exploited by an unauthenticated attacker using a specially crafted BFD packet, and no user interaction is required.

What is the expected impact of successful exploitation?

A successful attack can cause the affected system to reboot, resulting in a denial-of-service condition.

CVE-2026-121368: Security Advisory 0206

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require credentials or user interaction?

What is the expected impact of successful exploitation?