Arista's November 10, 2026 batch of EOS security advisories included three that sit in the routing stack rather than in a management service: Security Advisory 0221 for RIPv2 MD5 authentication, Security Advisory 0222 for the RPKI client that feeds BGP route origin validation, and Security Advisory 0223 for Seamless BFD. A fourth, Security Advisory 0219, covers IPsec AutoVPN and reaches far fewer boxes. None of these is on by default the way a management service is, so the first question for every owner is simple: does my configuration use the feature? This post walks through each advisory, which switch families Arista names, how to check your own configuration with the commands Arista gives, and which releases carry the fixes.
What Arista published on November 10, 2026
All four advisories carry the same date and are at revision 1.0. In short:
- Security Advisory 0221: two flaws in RIPv2 MD5 authentication, tracked as CVE-2026-121287 and CVE-2026-121288. An attacker on an adjacent network segment can crash the RIP process or get unauthorized routes accepted.
- Security Advisory 0222: two flaws in the RPKI client, tracked as CVE-2026-121291 and CVE-2026-121292. A hostile or hijacked RPKI cache can leave origin validation stuck or reset the RPKI agent.
- Security Advisory 0223: two flaws in Seamless Bidirectional Forwarding Detection (S-BFD), tracked as CVE-2026-121294 and CVE-2026-121295. The worse of the two can make a switch reboot.
- Security Advisory 0219: an IPsec AutoVPN replay window issue, CVE-2026-120974, on the AWE 5000 Series, the AWE 7200R Series and CloudEOS only.
For 0221 Arista says the company is not aware of any malicious exploitation of this vulnerability in customer networks, and the other three advisories say the same in their own words. That is a reason to plan the work, not a reason to skip it.
Advisory 0221: RIPv2 MD5 authentication
Arista describes it as an advisory that "covers two vulnerabilities in the Routing Information Protocol version 2 (RIPv2) MD5 authentication on Arista EOS-based products." The two problems are different in kind.
CVE-2026-121287 is a crash. An unauthenticated attacker on an adjacent segment can send crafted RIPv2 packets to a RIP-enabled interface and trigger the Rip agent crash without valid credentials. Arista adds that in a worst-case scenario the flaw may allow an attacker to execute arbitrary code on the affected device. It carries a CVSSv3.1 Base Score of 8.8.
CVE-2026-121288 is an authentication bypass. The attacker can bypass MD5 authentication and have unauthorized RIP route updates accepted by the device. Arista warns those routes could redirect traffic through attacker-controlled paths, create routing loops, or blackhole traffic. Its CVSSv3.1 Base Score is 8.1.
Exposure needs all three conditions Arista lists: RIP is enabled, MD5 authentication is configured on an interface, and the RIP network configuration matches the interface IP address. A switch that does not run RIP at all is not exposed, and neither is one running RIP without MD5 on the interface.
The families named for 0221 include the 7050X3/X4 Series, the 7060X/X2/X4/X5/X6/XE7 Series, the 7260X/X3 Series, the 7280R/R2/R3/R4 Series, the 7500R/R2/R3 Series, the 7020R/R4 Series, the 7010TX Series, the 720XP/722XPM Series and the 7800R3/R4 Series. Arista also gives a rule worth keeping in mind for every advisory in this batch: if your software release is not listed, your deployment is not vulnerable, regardless of the hardware platform in use.
Advisory 0222: the RPKI client behind BGP origin validation
RPKI matters to anyone who runs BGP at an edge and validates route origins. Arista describes the affected piece as the Resource Public Key Infrastructure (RPKI) client, which obtains Route Origin Authorization(ROA) data from an external cache for Border Gateway Protocol (BGP) route validation. The attacker in this case is someone controlling the RPKI cache, or the path between router and cache.
CVE-2026-121291: a crafted Error Report can leave EOS stuck believing that a cache reset is in progress, which stops ROA publication, withdrawal reconciliation and BGP origin validation updates. In practice your origin validation quietly stops tracking changes. Releases before 4.35.0F are not affected by this one.
CVE-2026-121292: a malformed Error Report can make EOS read beyond packet boundaries, which can terminate the RPKI agent or expose unintended memory contents through logging. This one reaches back further: it covers End of Support trains beginning with 4.24.0F. Both carry a CVSSv3.1 Base Score of 8.2.
The condition is narrow. A switch must have one or more RPKI caches configured and establish an RPKI-to-Router (RPKI-RTR) session. If RPKI is not configured, Arista says these issues cannot be reached through the RPKI protocol. To check, run show bgp rpki cache. For signs of trouble, Arista points to log lines reading "Received malformed Error Report PDU from cache server" and asks you to review the Internal Error, No Data and Corrupt Data counters against values you recorded before.
There is no mitigation. Clearing the affected cache with clear bgp rpki cache, or restarting the RPKI agent, may recover a stuck synchronization state, but Arista notes it does not prevent recurrence.
Advisory 0223: Seamless BFD reflector and initiator
S-BFD is used for fast failure detection, often alongside segment routing. Advisory 0223 covers two settings.
CVE-2026-121294 needs the S-BFD reflector proxy. A crafted S-BFD PDU might make the switch temporarily cease reflecting S-BFD packets, which can time out the S-BFD sessions that depend on it. CVSSv3.1 Base Score: 5.3. You are exposed if show running-config section sbfd prints a reflector local-discriminator line with the proxy keyword.
CVE-2026-121295 is the serious one. On a switch configured as an S-BFD initiator with round-trip delay measurement turned on, a crafted PDU could crash the kernel on the initiator, resulting in an unexpected device reboot. Its CVSSv3.1 Base Score is 8.6 and its CVSSv4.0 Base Score is 9.2. You are exposed if the same command shows initiator measurement delay round-trip.
The platform list is shorter than for 0221 and 0222. Arista names the 7280R/R2/R3/R4 Series, the 7500R/R2/R3 Series, the 7020R/R4 Series and the 7800R3/R4 Series, among others, as affected, and lists the 7050X3/X4 Series, the 7060X/X2/X4/X5/X6/XE7 Series and the 7260X/X3 Series as not affected. Arista lists no indicators of compromise and no mitigation for either flaw.
Advisory 0219: IPsec AutoVPN, and who can skip it
Advisory 0219 concerns IPsec AutoVPN with dynamic paths: the configured replay window may not be applied as expected. Arista states it does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic. Both IPsec AutoVPN and the anti-replay window must be enabled. The affected products are the AWE 5000 Series, the AWE 7200R Series and CloudEOS. Arista lists the 7050X/X2/X3/X4 Series, the 7060X/X2/X4/X5/X6/XE7 Series, the 7260X/X3 Series, the 7280E/R/R2/R3/R4 Series and the 7500E/R/R2/R3 Series among the platforms not affected, so most data center switch owners can note it and move on.
Which families each advisory names
| Family | 0221 RIPv2 MD5 | 0222 RPKI | 0223 S-BFD | 0219 AutoVPN |
|---|---|---|---|---|
| 7050X3/X4 Series | Affected | Affected | Not affected | Not affected |
| 7060X/X2/X4/X5/X6/XE7 Series | Affected | Affected | Not affected | Not affected |
| 7260X/X3 Series | Affected | Affected | Not affected | Not affected |
| 7280R/R2/R3/R4 Series | Affected | Affected | Affected | Not affected |
| 7500R/R2/R3 Series | Affected | Affected | Affected | Not affected |
Affected means the hardware is on Arista's list. Your exposure still depends on the release you run and on whether the feature is configured.
What to do now
First, find the release. Each advisory lists affected trains; for 0221, for example, they include 4.37.0F, all releases in the 4.32.x train and all releases in the End of Support software release trains.
Second, check the configuration for each feature:
- RIP with MD5: look at the router rip section and the interface lines for rip authentication. If you find RIP running where you do not need it, Arista's mitigation is to disable it within each affected VRF instance. Arista warns that disabling RIP or changing network statements may withdraw routes and interrupt connectivity, so plan a change window, confirm alternate routing, and verify the resulting configuration and route behavior.
- RPKI: run show bgp rpki cache.
- S-BFD: run show running-config section sbfd and look for the proxy keyword and the round-trip measurement line.
Third, look for signs. For the RIP crash, check show logging | include Rip for unexpected Rip agent termination or repeated restarts. For the route injection, compare show ip route against your approved design for unexpected RIP-learned routes, unapproved next hops or more-specific routes.
Fourth, upgrade. Advisories 0221, 0222 and 0223 are fixed in 4.36.3M and later releases in the 4.36.x train, 4.35.7M and later releases in the 4.35.x train, 4.34.9M and later releases in the 4.34.x train and 4.33.11M and later releases in the 4.33.x train. Advisory 0223 also lists 4.37.0F and later releases in the 4.37.x train. Note that 4.37.0F itself is on the affected list for 0221 and 0222, so a switch on that release still needs a move for those two. No hotfix is offered for 0221, 0222 or 0223.
If you are buying Arista switches now
A used switch runs whatever release its last owner loaded, and these advisories follow the release, not the serial number. Read the version on arrival and load a fixed release in a supported train before the switch carries traffic. If your design uses RIP with MD5, RPKI validation or S-BFD, the families named above are worth planning around: the 7280R/R2/R3/R4 Series and 7500R/R2/R3 Series appear in all three routing advisories, while the 7050X3/X4 Series and 7260X/X3 Series appear in the RIP and RPKI ones but not the S-BFD one. None of this changes which hardware is a good fit; it changes what goes into your standard build.
In stock at Townsend
We have these Arista switches in stock: an Arista 7280R Series switch (R3 generation), an Arista 7280R Series switch (R3 generation, K model) and an Arista 7060X Series switch (X4 generation). Browse the Arista 7280R Series collection, R3 generation or all Arista switches, or send your list through the quote page.