External risk intelligence

Arista EOS BGP Agent Crash and Potential Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-121289

The vulnerability affects the BGP agent on networking equipment. While BGP peers can be network-reachable, they are typically configured between trusted routers within internal networks or specific peering relationships, not exposed directly to the public internet for general access. Public internet exposure is uncommon and restricted by network architecture and access controls.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in Arista EOS networking software, when BGP is configured, could allow a specially crafted network packet to crash the BGP agent. This could disrupt network routing and, in more advanced scenarios, potentially lead to full system compromise. The main concern is confirming relevance and exposure.

BGP agent crash disrupts network routing.
Affects critical network infrastructure.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could target a network device running Arista EOS with BGP configured by sending a specially crafted packet. This packet would interact with the BGP agent, potentially leading to its termination. If successful, this could disrupt network routing and, in some cases, allow for arbitrary code execution, compromising the system's confidentiality and integrity.

Network access is required.
Specially crafted BGP packet triggers.
Loss of routing and potential code execution.

Live Threat

Current exploitation, exposure, and threat context

On affected platforms running Arista EOS with BGP configured, a specially crafted packet could cause the BGP agent to crash, leading to the loss of BGP sessions and potential network routing disruption. When supported by the advisory, a sophisticated attacker may also achieve arbitrary code execution, potentially compromising system confidentiality and integrity.

Network routing disruption is at risk.
Specially crafted packets could trigger crashes.
System compromise could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this vulnerability affecting Arista EOS with BGP configured, network infrastructure and security teams are likely responsible for managing the affected devices. The initial practical step is to identify all instances of Arista EOS with BGP, determine their reachability and criticality, and then assign ownership for remediation planning.

Network infrastructure and security teams own.
Verify BGP configuration and device exposure.
Plan for BGP session recovery and patching.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Arista EOS?

Arista EOS is the primary network operating system used on Arista hardware. It powers switches and routers that manage data flow across enterprise, cloud, and data center networks. By running the Border Gateway Protocol (BGP), these devices exchange routing information with other networks to direct traffic efficiently. This vulnerability specifically impacts that BGP communication process.

How does CVE-2026-121289 affect Arista EOS?

This issue is classified as CWE-121, or a stack-based buffer overflow. It means the BGP agent on the device fails to safely handle a specially crafted network packet. This flaw can cause the process to crash, immediately dropping BGP sessions. In more severe cases, the malformed data can allow an attacker to execute their own code on the device, potentially taking over the entire system.

What triggers this BGP agent vulnerability?

The vulnerability requires the delivery of a specially crafted packet over the network to a device running Arista EOS with BGP enabled. It is not triggered by standard, legitimate BGP routing traffic. If BGP is not configured or enabled on the device, the vulnerable agent is not active, and the system is not susceptible to this specific crash.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal notes that while BGP peers are network-reachable, they are typically limited to trusted internal networks or established peering connections rather than the open internet. Because public exposure is uncommon due to standard architectural controls, the likelihood of an external attacker reaching these BGP sessions is considered low, though internal risks remain.

What should I do first to manage this threat?

Start by auditing your network infrastructure to identify which devices are running Arista EOS and have BGP enabled. Once you have a clear inventory, assess the criticality of those devices and their current network reachability. Coordinate with your network operations team to confirm the BGP configuration and begin planning for necessary patches or updates.

References

www.arista.com/en/support/advisories-notices/security-advisory/25030…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.