Quick answers
- Is CVE-2026-120974 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-120974 being exploited in the wild.
- How severe is CVE-2026-120974?
- Medium severity, with a CVSS score of 5.3, published 10 November 2026.
- Which products and versions are affected?
- Arista AWE 5000 Series affected when running vulnerable EOS versions; Arista AWE 7200R Series affected when running vulnerable EOS versions; Arista CloudEOS affected when running vulnerable EOS versions; Arista Eos 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, all 4.30.x, all 4.29.x, 4.28.13M and below (4.28.x), all 4.27.x.
- Is there a fix for CVE-2026-120974?
- Yes: fixed in EOS 4.37.0F and later (4.37.x), 4.36.2F and later (4.36.x), 4.35.6M and later (4.35.x), 4.34.8M and later (4.34.x), 4.33.9M and later (4.33.x), 4.28.14M and later (4.28.x). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-120974 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-120974?
- Check whether you run Arista AWE 5000 Series, Arista AWE 7200R Series, Arista CloudEOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: EOS 4.37.0F and later (4.37.x), 4.36.2F and later (4.36.x), 4.35.6M and later (4.35.x), 4.34.8M and later (4.34.x), 4.33.9M and later (4.33.x), 4.28.14M and later (4.28.x)
Technical details
The vulnerability is an authentication bypass via capture-replay (CWE-294) in the IPsec anti-replay detection mechanism. When IPsec AutoVPN with dynamic paths and anti-replay detection are both configured on affected platforms, the replay window is not properly applied, silently disabling anti-replay protection contrary to policy. Exploitation requires the specific configuration of both IPsec AutoVPN Feature and anti-replay window detection enabled; the attack is network-based with no authentication or user interaction required.
Affected products
- Arista EOS 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, all 4.30.x, all 4.29.x, 4.28.13M and below (4.28.x), all 4.27.x
- Arista AWE 5000 Series affected when running vulnerable EOS versions
- Arista AWE 7200R Series affected when running vulnerable EOS versions
- Arista CloudEOS affected when running vulnerable EOS versions
Timeline
- 2026-11-10: disclosed