{"id":"CVE-2026-7473","kind":"vulnerability","aliases":["CVE-2026-7473"],"related":[],"title":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual…","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","summary":"Arista EOS, the operating system on Arista network switches, incorrectly decapsulates and forwards unexpected tunneled packets whose destination IP matches the switch's configured decapsulation IP. An attacker can use crafted tunneled traffic to push packets through the switch in ways the operator did not intend. CISA lists this as actively exploited.","severity":"high","cvss":6.9,"epss":null,"exploited":true,"exploited_at":"2026-06-09T00:00:00+00:00","products":[{"name":"Arista Extensible Operating System","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"arista eos","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["arista","eos","exploited","infrastructure","network-switches","tunnels"],"not_affected_if":["no-tunnel-decapsulation-configured"],"how_to_check":null,"fix":"Apply the mitigations in Arista's vendor advisory, per CISA's required action; the specific version and steps are not in the sources.\nIf no mitigation is available, CISA directs discontinuing use of the affected product.","status":"open","published_at":"2026-06-05T17:17:02+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:33:55+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:33:55Z","model":"claude-haiku-5-5","output":{"fix":"Apply the mitigations in Arista's vendor advisory, per CISA's required action; the specific version and steps are not in the sources.\nIf no mitigation is available, CISA directs discontinuing use of the affected product.","summary":"Arista EOS, the operating system on Arista network switches, incorrectly decapsulates and forwards unexpected tunneled packets whose destination IP matches the switch's configured decapsulation IP. An attacker can use crafted tunneled traffic to push packets through the switch in ways the operator did not intend. CISA lists this as actively exploited.","category":"infrastructure","who_cares":["arista","eos","network-switches","tunnels"],"confidence":0.6,"analyst_note":"Find Arista's security advisory for CVE-2026-7473 to get affected and fixed EOS versions, the decapsulation config to check, and the exact mitigation; search Arista security advisories or the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-tunnel-decapsulation-configured"],"severity_if_unknown":"high"},"cost_usd":0.000401,"input_tokens":2110,"output_tokens":380,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':17A,20A '-7473':18A,21A 'activ':86B 'affect':2A,89C 'arista':5A,22A,26A,28B,36B,42B,92C 'attack':63B 'cisa':82B 'configur':11A,59B,98C,135C,159C 'craft':66B 'cve':16A,19A 'decap':106C 'decap-group':105C 'decapsul':10A,46B,60B,97C,122C,136C 'destin':53B,131C 'encapsul':113C 'eo':6A,29B,37B,93C 'eos':27A 'exploit':30B,87B,169C 'extens':103C 'extensible':23A 'forward':48B,124C 'generic':111C 'gre':110C 'group':107C 'incorrect':45B,121C 'infrastructur':31B 'intend':81B 'interfac':115C 'ip':54B,61B,132C,137C 'issu':163C 'lan':104C 'lead':151C 'list':83B 'match':55B,133C 'network':33B,43B 'network-switch':32B 'non':158C 'non-configur':157C 'occur':139C 'oper':39B,78B 'operating':24A 'packet':51B,71B,128C 'platform':3A,90C 'potenti':150C 'present':117C 'process':155C 'protocol':148C 'push':70B 'report':166C 'rout':112C 'run':4A,91C 'switch':34B,44B,57B,74B,119C,142C 'system':25A,40B 'traffic':68B,161C 'tunnel':9A,35B,50B,67B,96C,114C,127C,147C,160C 'type':149C 'unexpect':49B,126C,154C 'use':65B 'verifi':145C 'virtual':15A,102C 'vxlan':14A,101C 'way':76B 'whose':52B 'wild':172C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-06-05T17:17:02+00:00","kev":{"dateAdded":"2026-06-09","dueDate":"2026-06-23","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"psirt@arista.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-7473","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7473","severity":null,"published_at":"2026-06-09T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:21+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-7473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7473","severity":null,"published_at":"2026-06-05T17:17:02+00:00","modified_at":"2026-10-07T19:17:43+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}