What’s Vulnerable › Vulnerabilities
CVE-2026-2379: Arista EOS IPsec Tunnel Sequence Number Mismatch via Interface Flaps when Anti-Replay is Disabled
- Severity: medium (CVSS 5.9 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-05 · updated 2026-10-26
- Weakness: CWE-672
Description
On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with existing Security Associations, resulting in sequence number mismatches between tunnel endpoints potentially causing unstable communication.
Affected products
- Arista Networks EOS: from 4.34.0 through 4.34.3M; from 4.33.0M through 4.33.5M; from 4.32.0M through 4.32.7M; from 4.31.0M through 4.31.9M; from 4.30.0F before 4.31.0; from 4.29.0F before 4.30.0 — fixed in 4.28.0, 4.29.0, 4.30.0, 4.31.0
How to fix
Upgrade to a fixed version: Arista Networks EOS 4.28.0, 4.29.0, 4.30.0, 4.31.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-2379 or the next vulnerability affects your stack