CVE-2026-2379: Arista EOS IPSec Tunnel Instability – MEDIUM Risk Vulnerability

Technical summary

CVE-2026-2379 affects Arista EOS platforms with hardware IPSec acceleration when specific IPSec features are enabled. The root cause involves improper sequence number synchronization during IPSec tunnel re-establishment following physical interface flaps or agent restarts. When these events occur, existing Security Associations (SAs) are torn down and rebuilt, but the sequence number counters on one or both tunnel endpoints may not be properly reset or synchronized. This results in sequence number field mismatches in the IPSec header (RFC 4303), causing the receiving endpoint to reject inbound packets or classify them as out-of-order replay attacks. The issue is classified as CWE-672 (Improper Restoration of Previously Freed Memory or Resetting to Initial Values).

Business impact

Organizations relying on Arista switches with IPSec tunnels for encrypted WAN backhaul, SD-WAN overlays, or inter-site connectivity may experience unexpected tunnel outages coinciding with scheduled or unplanned maintenance windows. Since the issue is triggered by interface flaps and agent restarts—events that occur during network operations, troubleshooting, or device upgrades—customers may face unplanned downtime during these critical windows. Data confidentiality is not compromised (the CVSS vector reflects high confidentiality impact due to encryption being in use, not because it is broken), but availability of the encrypted tunnel is directly affected.

Affected systems

Arista EOS running on hardware platforms with native IPSec acceleration, where specific IPSec features have been enabled in the configuration. The vendor product list in the source data is empty; consult Arista's advisory and platform documentation to determine which specific EOS versions, hardware SKUs, and feature combinations trigger this issue. Contact your Arista sales or support representative with your platform model and EOS version to confirm exposure.

Exploitability

This vulnerability does not require active exploitation by an external attacker. It is triggered by legitimate operational events: physical link failures, scheduled maintenance restarts, or automatic agent recovery processes. An attacker cannot directly invoke IPSec tunnel re-establishment without network access and the ability to cause interface flaps, which implies significant network access or physical access. The medium CVSS score (5.9) reflects the requirement for these specific conditions to occur naturally or be orchestrated by someone with network control. The attack vector is Network, but the attack complexity is High, and there is no privilege escalation or integrity risk.

Remediation

Arista will provide a firmware patch that ensures sequence numbers are correctly synchronized when IPSec tunnels re-establish. Until patching is available, operational workarounds may include: minimizing scheduled maintenance windows, disabling non-essential IPSec features if they are not in use, or deploying redundant tunnel paths with automatic failover to reduce the impact of a single tunnel becoming unstable. Verify the specific patch version and applicability against your hardware platform and EOS version by consulting Arista's security advisory.

Patch guidance

Contact Arista directly or consult their security advisory for the EOS firmware version that resolves sequence number synchronization during tunnel re-establishment. Test patches in a non-production environment, paying particular attention to IPSec tunnel stability during simulated interface flaps and agent restarts. Coordinate patching with your change management window to minimize production impact, as the issue itself is most likely to manifest during maintenance events.

Detection guidance

Monitor Arista switch syslog output for IPSec-related messages, including tunnel state transitions, SA deletion and re-creation events, and sequence number mismatch warnings. Enable IPSec debugging on affected devices if your security operations center supports centralized logging. Track interface flap events and correlate them with IPSec tunnel outages or instability. Use Arista's monitoring APIs or CLI commands to query IPSec SA statistics (sequence number counters, packet drop rates) before and after planned maintenance. A sudden spike in IPSec packet drops coinciding with an interface flap or agent restart is a strong indicator of this issue.

Why prioritize this

Although the CVSS score is MEDIUM (5.9), prioritize patching for any Arista EOS deployments that carry encrypted inter-site traffic or business-critical WAN links. The vulnerability is not remotely exploitable in the traditional sense, but its impact during routine maintenance can cause unplanned downtime. Organizations with redundant IPSec tunnels or SD-WAN failover can afford to patch on a normal quarterly cycle; those with single tunnels or high-criticality links should prioritize faster patching.

Risk score, explained

The CVSS 3.1 score of 5.9 MEDIUM is driven by: (1) Network attack vector, reflecting that IPSec re-establishment can be triggered by network-initiated link failures; (2) High attack complexity, because the vulnerability requires specific operational conditions (interface flaps or agent restarts) to manifest; (3) High confidentiality impact, indicating that the encrypted tunnel's stability—and by extension, the protection of traffic confidentiality—is at stake; (4) no integrity or availability impact in the CVSS model, because packets are not modified, merely dropped. The actual business-critical impact may be higher in environments where IPSec provides essential connectivity.

Frequently asked questions