CVE-2026-7473

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-7473 5.8

Arista · Extensible Operating System · Added 2026-06-09 · Published 2026-06-05

3-Day Required KEV Automatable Active Exploitation

Details

VulnerabilityArista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

VendorArista

ProductExtensible Operating System

Date added2026-06-09

Due date2026-06-23

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CWECWE-1023

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Descriptions

KEV: Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

NVD: On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline3 days + forensic

Forensic (public)Required

Forensic (non-public)Required

Research metadata

Last researched2026-06-17 04:10 UTC

Wall time45s

Searches8

Component defaultno - only present when tunnel decapsulation configuration (VXLAN, decap-groups, or GRE tunnel interface) is explicitly configured by the administrator

Sources https://nvd.nist.gov/vuln/detail/CVE-2026-7473
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137
https://www.securityweek.com/no-patch-planned-for-exploited-arista-eos-vulnerability/
https://eclypsium.com/blog/arista-eos-tunnel-decapsulation-no-patch/
https://threat-modeling.com/arista-eos-tunnel-decapsulation-cve-2026-7473-kev/
https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html
https://www.cve.org/CVERecord?id=CVE-2026-7473
https://www.tenable.com/plugins/nessus/321106
https://securityaffairs.com/193464/security/u-s-cisa-adds-cisco-catalyst-sd-wan-arista-extensible-operating-system-eos-and-google-chromium-v8-flaws-to-its-known-exploited-vulnerabilities-catalog.html

Hunting hypothesis agent

Monitor for unexpected tunnel traffic (VXLAN/GRE) arriving on Arista EOS switch interfaces with decapsulation IPs configured, indicating attempts to exploit missing protocol type verification.

Research details

ComponentEOS VXLAN/GRE tunnel decapsulation handler (missing protocol type verification)

PreconditionsThe target must be an affected Arista EOS platform (7020R, 7280R/R2/R3, 7500R/R2, or 7800R3 Series) running a vulnerable EOS version. The device must have a tunnel decapsulation configuration (VXLAN, decap-groups, or GRE tunnel interface) present with a decapsulation IP configured on an interface. The attacker must be able to send crafted tunnel protocol packets to the switch interface where the destination IP matches the configured decapsulation IP. The switch does not verify the outer tunnel protocol type, causing it to decapsulate and forward unexpected tunneled traffic. Critically, Arista has stated no software patch will be issued — this is a design/configuration limitation that must be mitigated through access control, ACLs, or architectural changes. agent

DeliveryNetwork packet injection - the attacker sends crafted tunnel protocol packets (VXLAN, GRE, or other tunnel-encapsulated traffic) to an Arista EOS switch interface where the destination IP matches the configured decapsulation IP. The switch incorrectly decapsulates and forwards these packets without verifying the tunnel protocol type, regardless of whether the tunnel type is one the switch is configured to expect.

Public PoCno

Advisoryhttps://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

Exploit notesCVSS v3.1 attack complexity: LOW (AC:L). The vulnerability requires no authentication (PR:N) and no user interaction (UI:N). The attack vector is network (AV:N). However, exploitation requires the attacker to know or discover the decapsulation IP configured on the target switch and send appropriately crafted tunnel packets. CVSS v4.0 base score is 6.8. Per SecurityWeek and Eclypsium analyses, the vulnerability is trivial to exploit when decapsulation IPs are exposed — no software patch exists, making this a permanent configuration weakness.

SummaryCVE-2026-7473 is an actively exploited vulnerability in Arista EOS affecting switches where tunnel decapsulation configurations (VXLAN, GRE, decap-groups) are present. The switch fails to verify the tunnel protocol type before decapsulating packets that match a configured decapsulation IP, allowing an unauthenticated remote attacker to inject arbitrary tunnel traffic that gets decapsulated and forwarded as if it were legitimate. Affected platforms include 7020R, 7280R/R2/R3, 7500R/R2, and 7800R3 Series. Arista Security Advisory 0137 (SA-0137) documents the issue, and Arista has stated that no software patch will be issued — the vulnerability is a design limitation that must be mitigated administratively via ACLs, tunnel endpoint restrictions, or architecture changes. CISA added this to KEV on June 9, 2026, with a 3-day forensic triage timeline for publicly exposed instances. No public PoC exploit code has been identified. The vulnerability was discovered and reported prior to June 2026, sat unlisted for approximately a month, and is now under active exploitation in the wild.

Tia coverage

First reported2026-06-10

First exploit report2026-06-10

Exploit report → KEV1 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

arista-eos-cve-2026-7473-no-patch-will-be-released-cisa-kev-acti

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.