# CVE-2026-120974: Arista EOS IPsec anti-replay window bypass in AutoVPN

Source: https://junglewise.ai/threats/cve-2026-120974-on-affected-platforms-running-arista-eos-with-ipsec-autovpn  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-120974 · Severity: medium · CVSS 5.3 · Published 2026-11-10

Arista EOS is a network operating system used in switches and routing appliances. When IPsec AutoVPN with dynamic paths is configured, the anti-replay protection mechanism can silently fail to activate, allowing attackers to replay previously captured encrypted network traffic even though the operator expects replay protection to be active. This does not decrypt traffic but enables replay attacks on IPsec-protected communications.

Technologies: [Arista CloudEOS](https://junglewise.ai/threats/technologies/cloudeos), [Arista Eos](https://junglewise.ai/threats/technologies/eos). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-120974 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120974 being exploited in the wild.

**How severe is CVE-2026-120974?** Medium severity, with a CVSS score of 5.3, published 10 November 2026.

**Which products and versions are affected?** Arista AWE 5000 Series affected when running vulnerable EOS versions; Arista AWE 7200R Series affected when running vulnerable EOS versions; Arista CloudEOS affected when running vulnerable EOS versions; Arista Eos 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, all 4.30.x, all 4.29.x, 4.28.13M and below (4.28.x), all 4.27.x.

**Is there a fix for CVE-2026-120974?** Yes: fixed in EOS 4.37.0F and later (4.37.x), 4.36.2F and later (4.36.x), 4.35.6M and later (4.35.x), 4.34.8M and later (4.34.x), 4.33.9M and later (4.33.x), 4.28.14M and later (4.28.x). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120974 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-120974?** Check whether you run Arista AWE 5000 Series, Arista AWE 7200R Series, Arista CloudEOS or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in EOS 4.37.0F and later (4.37.x), 4.36.2F and later (4.36.x), 4.35.6M and later (4.35.x), 4.34.8M and later (4.34.x), 4.33.9M and later (4.33.x), 4.28.14M and later (4.28.x)

## Technical details

The vulnerability is an authentication bypass via capture-replay (CWE-294) in the IPsec anti-replay detection mechanism. When IPsec AutoVPN with dynamic paths and anti-replay detection are both configured on affected platforms, the replay window is not properly applied, silently disabling anti-replay protection contrary to policy. Exploitation requires the specific configuration of both IPsec AutoVPN Feature and anti-replay window detection enabled; the attack is network-based with no authentication or user interaction required.

## Affected products

- Arista EOS 4.36.1F and below (4.36.x), 4.35.5M and below (4.35.x), 4.34.7M and below (4.34.x), 4.33.8M and below (4.33.x), all 4.32.x, all 4.31.x, all 4.30.x, all 4.29.x, 4.28.13M and below (4.28.x), all 4.27.x
- Arista AWE 5000 Series affected when running vulnerable EOS versions
- Arista AWE 7200R Series affected when running vulnerable EOS versions
- Arista CloudEOS affected when running vulnerable EOS versions

## Timeline

- 2026-11-10: disclosed

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219](https://www.arista.com/en/support/advisories-notices/security-advisory/25041-security-advisory-0219)

## Related threats

- [Arista EOS path traversal in eAPI service](https://junglewise.ai/threats/cve-2026-121371-on-affected-eos-versions-with-the-eapi-service-enabled-a)
- [Arista EOS denial of service in PTP](https://junglewise.ai/threats/cve-2026-121370-on-affected-platforms-running-arista-eos-with-precision-time)
- [Arista EOS denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-121369-on-affected-platforms-running-arista-eos-under-specific-link)
- [Arista EOS BFD authentication out-of-bounds write](https://junglewise.ai/threats/cve-2026-121368-on-affected-platforms-running-arista-eos-with-bidirectional)
- [Arista EOS RIPv2 silent enablement on management interfaces](https://junglewise.ai/threats/cve-2026-121367-on-affected-arista-eos-platforms-with-routing-information)