CVE-2025-8873
High
Description
On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer.
SeverityHigh
CVSS7.5
Exploit probability—
ProductEOS
PublishedJun 4, 2026
First seenJun 4, 2026
Weakness typeCWE-1286CWE-1286
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Arista Networks EOS | 4.33.0M ≤ v ≤ 4.33.4M, 4.32.0M ≤ v ≤ 4.32.6.1M, 4.31.0M ≤ v ≤ 4.31.7.1M, 4.30.0M ≤ v ≤ 4.30.10M, 4.29.0M ≤ v ≤ 4.29.10.1M | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.