CVE-2026-7473: Arista EOS improper tunnel protocol verification in decapsulation

CVE-2026-7473 · Severity: critical · CVSS 5.8 · Exploited in the wild · Published 2026-06-05

Arista network switches running EOS may incorrectly process and forward network traffic that uses unauthorized tunneling protocols. This occurs when the device is configured for specific types of network virtualization (like VXLAN or GRE) but fails to verify if incoming traffic matches the expected protocol. An attacker could exploit this to bypass certain network traffic controls or inject unexpected data into the network, and there are reports that this vulnerability is being actively exploited.

Technologies: Arista Eos. Vendors: Arista.

Quick answers

Is CVE-2026-7473 exploited in the wild?
Yes. CVE-2026-7473 is known to be exploited in the wild, first recorded on 9 June 2026. Treat it as urgent.
How severe is CVE-2026-7473?
Critical severity, with a CVSS score of 5.8, published 5 June 2026.
Which products and versions are affected?
Arista Extensible Operating System (EOS).
Is there a fix for CVE-2026-7473?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-7473 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-7473?
Check whether you run Arista Eos or Arista Extensible Operating System. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Arista EOS platforms configured with tunnel decapsulation (such as VXLAN, GRE, or decap-groups) fail to properly verify the tunnel protocol type of incoming packets. If a packet's destination IP matches a configured decapsulation IP, the switch may incorrectly decapsulate and forward the payload even if it uses a non-configured or unexpected tunnel protocol. This vulnerability, classified as CWE-1023 (Incomplete Comparison with Missing Factors), allows for the processing of unauthorized tunnel traffic. The issue is reachable over the network without authentication and has been reported as exploited in the wild.

Affected products

  • Arista Extensible Operating System (EOS)

Timeline

  • 2026-06-05: advisory: Initial publication by Arista Networks
  • 2026-06-05: exploited: Reported as being exploited in the wild at time of disclosure

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.