{"api_version":"1","generated_at":"2026-11-12T23:45:47+00:00","cve":"CVE-2026-120974","urls":{"html":"https://cve.report/CVE-2026-120974","api":"https://cve.report/api/cve/CVE-2026-120974.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120974","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120974"},"summary":{"title":"Security Advisory 0219","description":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.","state":"PUBLISHED","assigner":"Arista","published_at":"2026-11-10 20:18:52","updated_at":"2026-11-12 19:24:37"},"problem_types":["CWE-294","CWE-294 CWE-294 Authentication Bypass by Capture-replay"],"metrics":[{"version":"4.0","source":"psirt@arista.com","type":"Secondary","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"DECLARED","score":"6.9","severity":"MEDIUM","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L","data":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L","version":"4.0"}},{"version":"3.1","source":"psirt@arista.com","type":"Secondary","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"5.3","severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","data":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219","name":"https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219","refsource":"psirt@arista.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120974","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120974","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.27.0F 4.28.0F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.28.0F 4.28.13M custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.29.0F 4.30.0F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.30.0F 4.31.0F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.31.0F 4.32.0F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.32.0F 4.33.0F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.33.0F 4.33.8M custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.34.0F 4.34.7M custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.35.0F 4.35.5M custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]},{"source":"CNA","vendor":"Arista Networks","product":"EOS","version":"affected 4.36.0F 4.36.1F custom","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","platforms":["AWE 5000 Series","AWE 7200R Series","CloudEOS"],"product":"EOS","vendor":"Arista Networks","versions":[{"lessThan":"4.28.0F","status":"affected","version":"4.27.0F","versionType":"custom"},{"lessThanOrEqual":"4.28.13M","status":"affected","version":"4.28.0F","versionType":"custom"},{"lessThan":"4.30.0F","status":"affected","version":"4.29.0F","versionType":"custom"},{"lessThan":"4.31.0F","status":"affected","version":"4.30.0F","versionType":"custom"},{"lessThan":"4.32.0F","status":"affected","version":"4.31.0F","versionType":"custom"},{"lessThan":"4.33.0F","status":"affected","version":"4.32.0F","versionType":"custom"},{"lessThanOrEqual":"4.33.8M","status":"affected","version":"4.33.0F","versionType":"custom"},{"lessThanOrEqual":"4.34.7M","status":"affected","version":"4.34.0F","versionType":"custom"},{"lessThanOrEqual":"4.35.5M","status":"affected","version":"4.35.0F","versionType":"custom"},{"lessThanOrEqual":"4.36.1F","status":"affected","version":"4.36.0F","versionType":"custom"}]}],"configurations":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<pre>switch> show running-config all section key controller\nip security\n   key controller\n      profile dp\n      dh-group 16\n      lifetime 1 hours\n\nswitch> show running-config all section anti-replay\nip security\n   sa policy dynamic-sa\n      anti-replay detection\n\nswitch> show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A</pre>"}],"value":"switch> show running-config all section key controller\nip security\n   key controller\n      profile dp\n      dh-group 16\n      lifetime 1 hours\n\nswitch> show running-config all section anti-replay\nip security\n   sa policy dynamic-sa\n      anti-replay detection\n\nswitch> show ip security key controller local\nDH group: 16\nCrypto suite: 128-bit AES , 256bit Hash\nInitial DH key created: 22 hours, 46 minutes, 43 seconds\nLast DH key created: 9 hours, 29 minutes, 40 seconds\nDH rekey: N/A"}],"descriptions":[{"lang":"en","value":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic."}],"impacts":[{"capecId":"CAPEC-60","descriptions":[{"lang":"en","value":"CAPEC-60 Reusing Session IDs (aka Session Replay)"}]}],"metrics":[{"cvssV3_1":{"baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","version":"3.1"}},{"cvssV4_0":{"baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L","version":"4.0"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-294","description":"CWE-294 Authentication Bypass by Capture-replay","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-10T20:09:50.760Z","orgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","shortName":"Arista"},"references":[{"tags":["vendor-advisory"],"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219"}],"source":{"advisory":"Security Advisory 0219","defects":["1570728"],"discovery":"INTERNAL"},"title":"Security Advisory 0219"}},"cveMetadata":{"assignerOrgId":"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7","assignerShortName":"Arista","cveId":"CVE-2026-120974","datePublished":"2026-11-10T20:09:50.760Z","dateReserved":"2026-11-03T05:14:06.127Z","dateUpdated":"2026-11-10T20:09:50.760Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-10 20:18:52","lastModifiedDate":"2026-11-12 19:24:37","problem_types":["CWE-294","CWE-294 CWE-294 Authentication Bypass by Capture-replay"],"metrics":{"cvssMetricV40":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.9,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"HIGH","subAvailabilityImpact":"LOW","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"psirt@arista.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","baseScore":5.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"LOW"},"exploitabilityScore":3.9,"impactScore":1.4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120974","Ordinal":"1","Title":"Security Advisory 0219","CVE":"CVE-2026-120974","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120974","Ordinal":"1","NoteData":"On affected platforms running Arista EOS with IPsec AutoVPN Feature configured with dynamic paths, the configured IPsec replay window may not be applied as expected. As a result, IPsec anti-replay protection may be silently inactive even when it has been configured via an SA policy, contrary to the operator's expectation. This issue does not allow decryption of the affected IPsec traffic, but it may allow replay of previously valid protected traffic.","Type":"Description","Title":"Security Advisory 0219"}]}}}