Arista EOS: crafted BGP packet from a peer restarts the BGP agent when VPLS-BGP is enabled

CVSS 6.0CVE-2026-120980Firmware, BMC & network fabriccurated

Impact

An established BGP peer can send a crafted packet that makes the EOS BGP agent restart unexpectedly. Sessions drop and routes are withdrawn until it recovers. Repeating the packet could keep the control plane unstable. Only switches with VPLS-BGP enabled are affected, so most leaf-spine GPU fabrics that run plain BGP or EVPN without VPLS are not exposed.

Who can reach it

An attacker who already has an established BGP session with the PE router, which means a configured peer or a compromised one. Only switches with VPLS-BGP enabled are affected.

What to do

Upgrade EOS to a fixed release from Arista Security Advisory 0214. The record does not list fixed versions. On switches that are not redundant, an EOS upgrade disrupts traffic, so schedule it per switch or use your platform's hitless upgrade path where supported. Restricting BGP peering to trusted, authenticated neighbors limits who can reach the flaw.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120980 https://www.arista.com/en/support/advisories-notices/security-advisory/25036-security-advisory-0214

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.