CVE-2026-120974 · Infrastructure
NO FIX YET
On Arista EOS devices using IPsec AutoVPN with dynamic paths, the configured IPsec replay window may not be applied, so anti-replay protection can be silently off. An attacker may be able to replay previously valid protected traffic, but the flaw does not allow decryption of that traffic.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Networks running Arista EOS with IPsec AutoVPN using dynamic paths and an SA policy that sets an IPsec replay window. Devices without AutoVPN dynamic paths, or without IPsec, are not described as affected. The sources do not list affected EOS versions.
Not affected if no-autovpn, no-dynamic-paths, no-ipsec
Who cares arista-eos, autovpn, ipsec, network-gear
unknown for the exact command in the sources)No fix yet, per the sources.
On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.