CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors
Attackers can bypass tunnel decapsulation controls on Arista EOS switches by sending unexpected tunnel protocols, leading to unauthorized packet forwarding.
- Exploited in the wild
- Since 9 Jun 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-7473?
CVE-2026-7473 is a medium-severity vulnerability in Arista Networks EOS, published on 5 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.
This issue has been reported as being exploited in the wild.
Weakness: CWE-1023
Which versions are affected by CVE-2026-7473?
It affects 1 product.
Products include Arista Eos.
How do I fix CVE-2026-7473?
No fix has been published for CVE-2026-7473 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 23 Jun 2026.
Is CVE-2026-7473 being exploited?
Yes. Attackers have exploited CVE-2026-7473 in the wild since at least 9 Jun 2026.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Arista Networks EOS
Sources
Also known as GHSA-mcx4-vm6v-r473.