Arista EOS BGP: crafted messages from a peer force repeated session resets

CVSS 8.7CVE-2026-120982Firmware, BMC & network fabriccurated

Impact

An attacker who can set up a BGP peering session with an affected switch can send crafted BGP messages that reset the session over and over. That disrupts routing and traffic forwarding for as long as the attack lasts. On a GPU fabric that runs BGP (common in leaf-spine RoCE and EVPN designs), flapping sessions can stall distributed training jobs and cut nodes off from storage. The record gives no affected versions and no detail on the message type.

Who can reach it

Anyone able to establish a BGP peering session with the switch. That means a configured or accepted peer, or a position that lets the attacker impersonate one. No authentication beyond the BGP session itself. Only devices with BGP configured are affected.

What to do

Upgrade EOS to a fixed release from Arista Security Advisory 0207. Upgrading EOS means reloading each switch, so roll through redundant pairs. Until then, limit BGP peering to known neighbors (peer ACLs, TCP-AO/MD5 where in use) and watch for session flaps.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-120982 https://www.arista.com/en/support/advisories-notices/security-advisory/25029-security-advisory-0207

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.