CVE-2026-7473

Arista Extensible Operating System Incomplete Comparison with Missing Factors

5.8 MEDIUMActively exploited (CISA KEV)EPSS 0.65%

Published5 Jun 2026
Added to CISA KEV9 Jun 2026
Remediation due23 Jun 2026

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityNone

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Affected products

Arista Eosall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137Broken Link
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137MitigationVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473US Government Resource

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-7473 being actively exploited?

Yes. CVE-2026-7473 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 9 Jun 2026.

How severe is CVE-2026-7473?

CVE-2026-7473 has a CVSS 3.1 base score of 5.8, rated medium. EPSS estimates a 0.65% probability of exploitation.

Which products are affected by CVE-2026-7473?

Affected products include Arista Eos.

How do I fix CVE-2026-7473?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-7473 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, a risk for it never ranks below high, and the update that fixes it moves to the Emergency patch lane. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.