---
id: "CVE-2026-120974"
page: "https://infrastack.ai/live/CVE-2026-120974"
kind: "vulnerability"
aliases: ["CVE-2026-120974"]
title: "Arista EOS: IPsec replay protection can silently stay inactive on AutoVPN"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["arista-eos", "autovpn", "infrastructure", "ipsec", "network-gear"]
not_affected_if: ["no-autovpn", "no-dynamic-paths", "no-ipsec"]
published_at: "2026-11-10T20:18:52+00:00"
first_seen_at: "2026-11-10T20:46:02+00:00"
updated_at: "2026-11-10T20:48:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120974", "first_seen_at": "2026-11-10T20:46:02+00:00"}]
exploit_sources: []
---

# Arista EOS: IPsec replay protection can silently stay inactive on AutoVPN

Link for people: https://infrastack.ai/live/CVE-2026-120974 (this .md is for agents)

On Arista EOS devices using IPsec AutoVPN with dynamic paths, the configured IPsec replay window may not be applied, so anti-replay protection can be silently off. An attacker may be able to replay previously valid protected traffic, but the flaw does not allow decryption of that traffic.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the device runs Arista EOS with IPsec AutoVPN configured with dynamic paths
- Check the SA policy replay window setting on the device and whether it is actually applied (`unknown` for the exact command in the sources)

## Timeline

- 2026-11-10T20:46:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120974

## From the sources

On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_