External risk intelligence

Arista EOS PTP Denial of Service Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-121370

The vulnerability affects Precision Time Protocol (PTP) in Arista EOS. PTP is a specialized protocol typically deployed within local network segments or controlled industrial environments to synchronize clocks. While network-reachable, PTP is rarely exposed directly to the public internet, and such exposure would generally be considered an unusual or misconfigured deployment.

Denial of Service

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

An unauthenticated attacker can cause a denial of service on Arista EOS devices by sending specially crafted traffic to a PTP-enabled port. This vulnerability affects the Precision Time Protocol configuration on these platforms and could disrupt network operations.

An attacker can disrupt service on Arista devices.
Leadership should monitor for PTP protocol exposure.
Confirm relevance and potential exposure of PTP configurations.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker on the network can trigger a denial-of-service condition on Arista EOS devices by sending traffic to a PTP-enabled port. This attack targets the Precision Time Protocol (PTP) configuration, potentially disrupting system availability.

No authentication required.
Send traffic to PTP-enabled port.
Causes denial of service.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access could disrupt the normal operation of Arista EOS devices configured with Precision Time Protocol (PTP). This could happen when PTP traffic is sent to a PTP-enabled port, potentially leading to a denial of service.

Affected asset: PTP service availability.
Exposure: Network traffic to PTP port.
Consequence: Service disruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Arista EOS platform, when configured with Precision Time Protocol (PTP), is vulnerable to a denial-of-service attack. Network and security teams should first confirm the presence and reachability of PTP-enabled ports on Arista devices within the environment. Subsequently, the asset owners or responsible platform teams must be identified to coordinate remediation efforts, prioritizing business-critical systems.

Identify Arista EOS PTP asset owners.
Verify PTP port reachability and criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Arista EOS and why does it use PTP?

Arista EOS is a high-performance network operating system used in enterprise and data center switches. It includes Precision Time Protocol (PTP), a specialized networking standard designed to synchronize clocks across devices with high accuracy. PTP is commonly used in high-frequency trading, telecommunications, and industrial automation where precise timing is required to coordinate network operations.

What is the vulnerability class for CVE-2026-121370?

CVE-2026-121370 is identified as CWE-770, which refers to 'Allocation of Resources Without Limits or Throttling.' In the context of this Arista EOS vulnerability, it means the PTP service lacks sufficient controls to manage incoming traffic, allowing an unauthenticated attacker to exhaust system resources and trigger a denial-of-service condition.

How is this Arista EOS vulnerability triggered?

The vulnerability is triggered when an attacker sends specially crafted traffic directly to a PTP-enabled port on an affected device. No authentication is required to initiate this process. The condition is not triggered if PTP is disabled on the device or if the PTP-enabled ports are logically segmented away from the attacker's network path.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal classifies this vulnerability as 'Unlikely' for most environments. Because PTP is a specialized protocol, it is typically restricted to local network segments or controlled industrial zones rather than the public internet. Unless your PTP-enabled ports are misconfigured and directly exposed to external, untrusted networks, the risk of an external attacker reaching them is low.

What steps should I take if I use Arista EOS?

Begin by auditing your network environment to identify which Arista EOS devices have PTP enabled. Verify the reachability of these PTP ports to determine if they are exposed to unauthorized network segments. Once identified, coordinate with your platform and security teams to restrict access to these ports or apply the recommended updates provided by Arista to mitigate the risk of service disruption.

References

www.arista.com/en/support/advisories-notices/security-advisory/25046…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.