Reported by 2 outlets

Timeline

1. original reporting

   Arista EOS CVE-2026-7473 — No Patch Will Be Released, CISA KEV, Actively Exploited Tunnel Decapsulation Bypass

   securityweek.com · 126d ago · June 10th, 2026

   Arista confirmed active exploitation of CVE-2026-7473 (CVSS 6.9) in its Extensible Operating System (EOS), a tunnel protocol validation bypass affecting devices configured as tunnel endpoints (GRE, VXLAN, decap-groups). The switch incorrectly decapsulates and forwards unexpected tunnel protocols destined to the same IP — enabling traffic injection, reconnaissance, and potential data exfiltration.

   Arista will not release a patch. The vendor explicitly states "no software upgrade path is planned due to the risk of breaking existing configurations," directing customers to apply manual configuration mitigations instead. CISA added the flaw to its KEV catalog on Tuesday covering 7020R, 7280R/R2, 7500R/R2, 7280R3, 7500R3, and 7800R3 series. A vendor refusing to patch an actively exploited internet-facing vulnerability is extremely rare and signals that organizations must treat the mitigation instructions as emergency priority. Federal agencies have two weeks under BOD 22-01.

   ---

2. update from malware.news

   Arista EOS Tunnel Bug (CVE-2026-7473) — No Patch Coming, Vulnerability Scanners Will Miss It

   malware.news · 119d ago · June 17th, 2026

   An actively exploited vulnerability in Arista EOS switches (CVE-2026-7473) allows attackers to bypass network segmentation by sending traffic in an unconfigured tunnel protocol to a decapsulation IP address — the switch unwraps and forwards it regardless of protocol. There is no software fix planned. Arista says changing decapsulation behavior would break existing deployments. The vulnerability lives entirely in configuration, not a version string, meaning version-based vulnerability scanners will either miss it or generate overwhelming false positives. Arista flagged in-the-wild exploitation on May 5, but the CVE did not appear in public databases for weeks and only landed on CISA's KEV on June 9 — a five-week visibility gap. Admins must inventory tunnel endpoints via show ip decap-group, apply upstream ACLs restricting tunnel protocols, and validate using configuration auditing, not version checking.