{
  "document": {
    "category": "security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "publisher": {
      "category": "vendor",
      "contact_details": "support@arista.com",
      "name": "Arista PSIRT",
      "namespace": "https://www.arista.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Security advisory 210 canonical URL",
        "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25032-security-advisory-0210"
      }
    ],
    "title": "Security Advisory 210",
    "tracking": {
      "current_release_date": "2026-11-08T09:58:19Z",
      "generator": {
        "engine": {
          "name": "Arista Networks SecEng Service CSAF Generator"
        }
      },
      "id": "Arista Networks Security Advisory 210",
      "initial_release_date": "2026-11-08T09:58:19Z",
      "revision_history": [
        {
          "date": "2026-11-08T09:58:19Z",
          "number": "1",
          "summary": "Document created"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version",
                    "name": "EOS version 4.35.7",
                    "product": {
                      "name": "EOS version 4.35.7",
                      "product_id": "CSAFPID-5"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 1.0.0",
                    "product": {
                      "name": "EOS version 1.0.0",
                      "product_id": "CSAFPID-3"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.36.3",
                    "product": {
                      "name": "EOS version 4.36.3",
                      "product_id": "CSAFPID-0"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.33.11",
                    "product": {
                      "name": "EOS version 4.33.11",
                      "product_id": "CSAFPID-1"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.37.0",
                    "product": {
                      "name": "EOS version 4.37.0",
                      "product_id": "CSAFPID-2"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "EOS version 4.34.9",
                    "product": {
                      "name": "EOS version 4.34.9",
                      "product_id": "CSAFPID-4"
                    }
                  }
                ],
                "category": "product_name",
                "name": "EOS"
              }
            ],
            "category": "product_family",
            "name": "Software Products"
          }
        ],
        "category": "vendor",
        "name": "Arista Networks, Inc."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-121293",
      "id": {
        "system_name": "Arista Bug ID",
        "text": "1961865,1961866"
      },
      "notes": [
        {
          "category": "description",
          "text": "On affected EOS-based platforms, an attacker who controls a Border Gateway Protocol (BGP) peer can send a crafted BGP message over an established session with the Dynamic Path Selection (DPS) address family negotiated. This can cause the BGP process to terminate unexpectedly, resetting all BGP sessions and disrupting routing services until the process restarts.",
          "title": "CVE Description"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121293, at least one BGP peer with BGP address family \u201cpath-selection\u201d must be in an \u201cestablished\u201d state. To check, run the following show command.\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300               44        43    0    0 00:14:55 Estab   1      1      1\nevpnsfe1#\n```\nIf ALL BGP peers with the address family \u201cpath-selection\u201d are in any other states, there is no exposure to this issue, for example in the below show commands.\n\na. path-selection is not configured.\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\nevpnsfe1#\n```\nb. path-selection is configured but the BGP session is not established with peer (it may be down, or BGP itself not configured in the peer).\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300              112       338    0    0 00:00:13 Active\nevpnsfe1#\n```\nc. path-selection is configured, BGP session with peer is established but peer does not have path-selection configured.\n```\nevpnsfe1(config)#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300               15        16    0    0 00:05:47 Estab(NotNegotiated)\nevpnsfe1(config)#\n```\n",
          "title": "1961865: Required Config for Exploitation"
        },
        {
          "category": "other",
          "text": "In order to be vulnerable to CVE-2026-121293, at least one BGP peer with BGP address family \u201cpath-selection\u201d must be in an \u201cestablished\u201d state. To check, run the following show command.\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300               44        43    0    0 00:14:55 Estab   1      1      1\nevpnsfe1#\n```\nIf ALL BGP peers with the address family \u201cpath-selection\u201d are in any other states, there is no exposure to this issue, for example in the below show commands.\n\na. path-selection is not configured.\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\nevpnsfe1#\n```\nb. path-selection is configured but the BGP session is not established with peer (it may be down, or BGP itself not configured in the peer).\n```\nevpnsfe1#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300              112       338    0    0 00:00:13 Active\nevpnsfe1#\n```\nc. path-selection is configured, BGP session with peer is established but peer does not have path-selection configured.\n```\nevpnsfe1(config)#show bgp path-selection summary\nBGP summary information for VRF default\nRouter identifier 0.0.0.1, local AS number 300\nNeighbor Status Codes: m - Under maintenance\n  Neighbor V AS           MsgRcvd   MsgSent  InQ OutQ  Up/Down State   PfxRcd PfxAcc PfxAdv\n  12.0.0.3 4 300               15        16    0    0 00:05:47 Estab(NotNegotiated)\nevpnsfe1(config)#\n```\n",
          "title": "1961866: Required Config for Exploitation"
        }
      ],
      "product_status": {
        "first_affected": [
          "CSAFPID-3"
        ],
        "fixed": [
          "CSAFPID-0",
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-4",
          "CSAFPID-5"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "MITRE CVE Entry",
          "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121293"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-0"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.37.0",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 1.0.0",
          "product_ids": [
            "CSAFPID-3"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.33.11",
          "product_ids": [
            "CSAFPID-1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.34.9",
          "product_ids": [
            "CSAFPID-4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.35.7",
          "product_ids": [
            "CSAFPID-5"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.36.3",
          "product_ids": [
            "CSAFPID-0"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Fixed in EOS version 4.37.0",
          "product_ids": [
            "CSAFPID-2"
          ]
        },
        {
          "category": "none_available",
          "details": "Not fixed in EOS version 1.0.0",
          "product_ids": [
            "CSAFPID-3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0",
            "CSAFPID-4",
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-5"
          ]
        }
      ],
      "title": "CVE-2026-121293"
    }
  ]
}