CVE-2026-121295
CRITICAL
INFO
Priority: 0.04
BB Relevance:
78/100
Published: 2026-11-10
Modified: 2026-11-13
First seen: 2026-11-10
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
None
VI:
None
VA:
High
Description
On affected platforms running Arista EOS configured as S-BFD peers, an unauthenticated attacker could send a crafted S-BFD PDU to an initiator device. This crafted PDU could cause the kernel on the initiator device to crash, resulting in an unexpected device reboot.
Weakness Classification (1)
Affected Software (12)
| Vendor | Product | Version |
|---|---|---|
| Arista Networks | EOS | 4.36.0F |
| Arista Networks | EOS | 4.35.0F |
| Arista Networks | EOS | 4.34.0F |
| Arista Networks | EOS | 4.33.0F |
| Arista Networks | EOS | 4.32.0F < 4.33.0F |
| Arista Networks | EOS | 1.0.0 < 4.32.0F |
| Arista Networks | EOS | 4.36.0F |
| Arista Networks | EOS | 4.35.0F |
| Arista Networks | EOS | 4.34.0F |
| Arista Networks | EOS | 4.33.0F |
| Arista Networks | EOS | 4.32.0F < 4.33.0F |
| Arista Networks | EOS | 1.0.0 < 4.32.0F |
References & Advisories (1)
Change History
| Field | Old Value | New Value | Detected |
|---|---|---|---|
| cvss_base | 8.6 | 9.2 | 2026-11-13T18:30 |
| severity | high | critical | 2026-11-13T18:30 |
| cvss_base | 9.2 | 8.6 | 2026-11-13T18:00 |
| severity | critical | high | 2026-11-13T18:00 |