← Vulnerability Intelligence

CVE-2026-7473

Medium 5.8 Exploited in the wild (KEV)

Confirmed active exploitation — CISA KEV catalog

Name
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Added to catalog
Remediation due date (US federal)
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Metrics

CVSS 3.1
5.8 (MEDIUM) Score source: CNA CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS 4.0
6.9 (MEDIUM) Score source: CNA CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS — exploit probability
1% (percentile: 66) as of 1 November 2026
CWE
CWE-1023

Affected products

arista: eos; arista: 7020sr-24c2; arista: 7020sr-32c2; arista: 7020srg-24c2; arista: 7020tr-48; arista: 7020tra-48; arista: 7280cr-48; arista: 7280cr2-60; arista: 7280cr2a-30; arista: 7280cr2a-60; arista: 7280cr2k-30; arista: 7280cr2k-60; arista: 7280cr2m-30; arista: 7280cr3-32d4; arista: 7280cr3-32p4

References