{ "document": { "category": "security_advisory", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en-US", "publisher": { "category": "vendor", "contact_details": "support@arista.com", "name": "Arista PSIRT", "namespace": "https://www.arista.com" }, "references": [ { "category": "self", "summary": "Security advisory 222 canonical URL", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25044-security-advisory-0222" } ], "title": "Security Advisory 222", "tracking": { "current_release_date": "2026-11-08T09:58:21Z", "generator": { "engine": { "name": "Arista Networks SecEng Service CSAF Generator" } }, "id": "Arista Networks Security Advisory 222", "initial_release_date": "2026-11-08T09:58:21Z", "revision_history": [ { "date": "2026-11-08T09:58:21Z", "number": "1", "summary": "Document created" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "branches": [ { "category": "product_version", "name": "EOS version 4.24.0", "product": { "name": "EOS version 4.24.0", "product_id": "CSAFPID-9" } }, { "category": "product_version", "name": "EOS version 4.34.9", "product": { "name": "EOS version 4.34.9", "product_id": "CSAFPID-11" } }, { "category": "product_version", "name": "EOS version 4.33.11", "product": { "name": "EOS version 4.33.11", "product_id": "CSAFPID-10" } }, { "category": "product_version", "name": "EOS version 4.35.0", "product": { "name": "EOS version 4.35.0", "product_id": "CSAFPID-8" } }, { "category": "product_version", "name": "EOS version 4.36.3", "product": { "name": "EOS version 4.36.3", "product_id": "CSAFPID-6" } }, { "category": "product_version", "name": "EOS version 4.35.7", "product": { "name": "EOS version 4.35.7", "product_id": "CSAFPID-7" } } ], "category": "product_name", "name": "EOS" } ], "category": "product_family", "name": "Software Products" } ], "category": "vendor", "name": "Arista Networks, Inc." } ] }, "vulnerabilities": [ { "cve": "CVE-2026-121291", "id": { "system_name": "Arista Bug ID", "text": "1936844" }, "notes": [ { "category": "description", "text": "A crafted Error Report can leave EOS stuck believing that a cache reset is in progress, preventing ROA publication, withdrawal reconciliation, and BGP origin-validation updates.", "title": "CVE Description" }, { "category": "other", "text": "To be vulnerable to CVE-2026-121291, an EOS device must have one or more RPKI caches configured and establish an RPKI-to-Router (RPKI-RTR) session. Operators can verify this with:\n\n```\nswitch> show bgp rpki cache\n```\n\nThe configuration should contain an RPKI cache entry under BGP, for example:\n\n```\nrouter bgp \n rpki cache \n host \n```", "title": "1936844: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-8" ], "fixed": [ "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121291" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-7" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-6" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.35.0", "product_ids": [ "CSAFPID-8" ] }, { "category": "mitigation", "details": "No mitigation is available for these vulnerabilities. Customers should upgrade to a remediated EOS release as soon as possible. For CVE-2026-121291, clearing the affected RPKI cache using `clear bgp rpki cache ` or restarting the RPKI agent may recover from a stuck synchronization state, but does not prevent recurrence." } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L", "version": "3.1" }, "products": [ "CSAFPID-6", "CSAFPID-8", "CSAFPID-7" ] } ], "title": "CVE-2026-121291" }, { "cve": "CVE-2026-121292", "id": { "system_name": "Arista Bug ID", "text": "1936846" }, "notes": [ { "category": "description", "text": "A malformed Error Report can cause EOS to read beyond packet boundaries, potentially terminating the RPKI agent or exposing unintended memory contents through logging.", "title": "CVE Description" }, { "category": "other", "text": "To be vulnerable to CVE-2026-121292, an EOS device must have one or more RPKI caches configured and establish an RPKI-to-Router (RPKI-RTR) session. Operators can verify this with:\n\n```\nswitch> show bgp rpki cache\n```\n\nThe configuration should contain an RPKI cache entry under BGP, for example:\n\n```\nrouter bgp \n rpki cache \n host \n```", "title": "1936846: Required Config for Exploitation" } ], "product_status": { "first_affected": [ "CSAFPID-9" ], "fixed": [ "CSAFPID-10", "CSAFPID-11", "CSAFPID-6", "CSAFPID-7" ] }, "references": [ { "category": "external", "summary": "MITRE", "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-121292" } ], "remediations": [ { "category": "vendor_fix", "details": "Fixed in EOS version 4.33.11", "product_ids": [ "CSAFPID-10" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.34.9", "product_ids": [ "CSAFPID-11" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.35.7", "product_ids": [ "CSAFPID-7" ] }, { "category": "vendor_fix", "details": "Fixed in EOS version 4.36.3", "product_ids": [ "CSAFPID-6" ] }, { "category": "none_available", "details": "Not fixed in EOS version 4.24.0", "product_ids": [ "CSAFPID-9" ] } ], "scores": [ { "cvss_v3": { "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1" }, "products": [ "CSAFPID-11", "CSAFPID-6", "CSAFPID-10", "CSAFPID-9", "CSAFPID-7" ] } ], "title": "CVE-2026-121292" } ] }