Live › vulnerability › CVE-2026-7473
Go to dashboardArista EOS, the operating system on Arista network switches, incorrectly decapsulates and forwards unexpected tunneled packets whose destination IP matches the switch's configured decapsulation IP. An attacker can use crafted tunneled traffic to push packets through the switch in ways the operator did not intend. CISA lists this as actively exploited.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 5h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Arista Extensible Operating System | vendor | – | – |
| arista eos | vendor | – | – |
Unknown from the sources.
s vendor advisory, per CISAs required action; the specific version and steps are not in the sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.
This issue has been reported as being exploited in the wild.
This page as .md · .json · in your agent: get_signal("CVE-2026-7473")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.