How severe is CVE-2026-7473?

CVE-2026-7473 has a CVSS 4.0 base score of 6.9 (MEDIUM). EPSS estimates a 0.6% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2026-7473: Arista EOS Unexpected Tunnel Protocol Decapsulation

CISA Known Exploited Vulnerabilities

Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2026-06-09

Remediation due

2026-06-23

Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA notes
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 ; https://nvd.nist.gov/vuln/detail/CVE-2026-7473

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

Severity

CVSS 3.1 · CNA5.8 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

CVSS 4.0 · CNA6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Affected Products

Vendor	Product	Affected versions
Arista Networks	EOS	4.36.0 4.35.0 to 4.35 4.34.0 to 4.34 4.33.0 to 4.33 4.32.0 to 4.32 4.31.0 to 4.31 ≤ 4.30

References

1 Links

Vendor advisories

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137

Record Details

Published

2026-06-05

Last updated

2026-06-10

Assigner (CNA)

Arista

Credited to

Scott Christiansen, Lukas Peitz, Rich Compton, and Jonathan Davis at Comcast

More from Arista Networks

CVE-2026-9395210

Security Advisory 0183

CVE-2026-1681210

VeloCloud Orchestrator OS Command Injection

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CWE-1023 · Incomplete Comparison with Missing Factors

Application Security Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.