{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-120974", "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "state": "PUBLISHED", "assignerShortName": "Arista", "dateReserved": "2026-11-03T05:14:06.127Z", "datePublished": "2026-11-10T20:09:50.760Z", "dateUpdated": "2026-11-10T20:09:50.760Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7", "shortName": "Arista", "dateUpdated": "2026-11-10T20:09:50.760Z"}, "title": "Security Advisory 0219", "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."}], "affected": [{"vendor": "Arista Networks", "product": "EOS", "defaultStatus": "unaffected", "versions": [{"version": "4.27.0F", "status": "affected", "versionType": "custom", "lessThan": "4.28.0F"}, {"version": "4.28.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.28.13M"}, {"version": "4.29.0F", "status": "affected", "versionType": "custom", "lessThan": "4.30.0F"}, {"version": "4.30.0F", "status": "affected", "versionType": "custom", "lessThan": "4.31.0F"}, {"version": "4.31.0F", "status": "affected", "versionType": "custom", "lessThan": "4.32.0F"}, {"version": "4.32.0F", "status": "affected", "versionType": "custom", "lessThan": "4.33.0F"}, {"version": "4.33.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.33.8M"}, {"version": "4.34.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.34.7M"}, {"version": "4.35.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.35.5M"}, {"version": "4.36.0F", "status": "affected", "versionType": "custom", "lessThanOrEqual": "4.36.1F"}], "platforms": ["AWE 5000 Series", "AWE 7200R Series", "CloudEOS"]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219", "tags": ["vendor-advisory"]}], "source": {"defects": ["1570728"], "advisory": "Security Advisory 0219", "discovery": "INTERNAL"}, "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-294", "description": "CWE-294 Authentication Bypass by Capture-replay"}]}], "configurations": [{"lang": "en", "value": "switch> show running-config all section key controller\nip security\n key controller\n profile dp\n dh-group 16\n lifetime 1 hours\n\nswitch> show running-config all section anti-replay\nip security\n sa policy dynamic-sa\n anti-replay detection\n\nswitch> show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<pre>switch> show running-config all section key controller\nip security\n key controller\n profile dp\n dh-group 16\n lifetime 1 hours\n\nswitch> show running-config all section anti-replay\nip security\n sa policy dynamic-sa\n anti-replay detection\n\nswitch> show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A</pre>"}]}], "impacts": [{"capecId": "CAPEC-60", "descriptions": [{"lang": "en", "value": "CAPEC-60 Reusing Session IDs (aka Session Replay)"}]}]}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "platforms": ["AWE 5000 Series", "AWE 7200R Series", "CloudEOS"], "product": "EOS", "vendor": "Arista Networks", "versions": [{"lessThan": "4.28.0F", "status": "affected", "version": "4.27.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.28.13M", "status": "affected", "version": "4.28.0F", "versionType": "custom"}, {"lessThan": "4.30.0F", "status": "affected", "version": "4.29.0F", "versionType": "custom"}, {"lessThan": "4.31.0F", "status": "affected", "version": "4.30.0F", "versionType": "custom"}, {"lessThan": "4.32.0F", "status": "affected", "version": "4.31.0F", "versionType": "custom"}, {"lessThan": "4.33.0F", "status": "affected", "version": "4.32.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.33.8M", "status": "affected", "version": "4.33.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.34.7M", "status": "affected", "version": "4.34.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.35.5M", "status": "affected", "version": "4.35.0F", "versionType": "custom"}, {"lessThanOrEqual": "4.36.1F", "status": "affected", "version": "4.36.0F", "versionType": "custom"}]}], "source": "psirt@arista.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."}], "id": "CVE-2026-120974", "lastModified": "2026-11-10T20:18:52.357", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "psirt@arista.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "psirt@arista.com", "type": "Secondary"}]}, "published": "2026-11-10T20:18:52.357", "references": [{"source": "psirt@arista.com", "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219"}], "sourceIdentifier": "psirt@arista.com", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-294"}], "source": "psirt@arista.com", "type": "Secondary"}]}

{}

{}