---
id: "CVE-2026-7473"
kind: "vulnerability"
aliases: ["CVE-2026-7473"]
title: "On affected platforms running Arista EOS where a tunnel decapsulation configuration\u2014such as VXLAN (Virtual\u2026"
severity: "high"
cvss: 6.9
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Arista Extensible Operating System", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "arista eos", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["arista", "eos", "exploited", "infrastructure", "network-switches", "tunnels"]
not_affected_if: ["no-tunnel-decapsulation-configured"]
published_at: "2026-06-05T17:17:02+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T23:44:51+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7473", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7473", "first_seen_at": "2026-10-23T23:44:51+00:00"}]
---

# On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual…

Arista EOS, the operating system on Arista network switches, incorrectly decapsulates and forwards unexpected tunneled packets whose destination IP matches the switch's configured decapsulation IP. An attacker can use crafted tunneled traffic to push packets through the switch in ways the operator did not intend. CISA lists this as actively exploited.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Arista Extensible Operating System affected ? fixed ?
- vendor:arista eos affected ? fixed ?

## Fix

Apply the mitigations in Arista's vendor advisory, per CISA's required action; the specific version and steps are not in the sources.
If no mitigation is available, CISA directs discontinuing use of the affected product.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-7473
- 2026-10-23T23:44:51+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-7473

## From the sources

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.



This issue has been reported as being exploited in the wild.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_