CVE-2026-7473 Details
Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
A vulnerability exists in Arista EOS platforms that have a tunnel decapsulation configuration, such as VXLAN, decap-groups, or GRE tunnel interfaces. The issue arises because the switch fails to verify the tunnel protocol type, allowing it to incorrectly decapsulate and forward unexpected tunneled packets that match the configured decapsulation IP. This misprocessing could lead to the unintended handling of non-specified tunnel traffic. According to Arista, this vulnerability has been exploited in the wild.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 | CISA-ADP | MitigationVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473 | CISA-ADP | US Government Resource |
| https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 | [email protected] | Broken Link |
This CVE is in CISA's Known Exploited Vulnerabilities Catalog
Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.
| Vulnerability Name | Date Added | Due Date | Required Action |
|---|---|---|---|
| Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability | Jun 9, 2026 | Jun 23, 2026 | Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1023 | Incomplete Comparison with Missing Factors | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| arista eos | All versions |
CPE
Remediation
| |
| arista 7020sr-24c2 | All versions |
CPE
Remediation
| |
| arista 7020sr-32c2 | All versions |
CPE
Remediation
| |
| arista 7020srg-24c2 | All versions |
CPE
Remediation
| |
| arista 7020tr-48 | All versions |
CPE
Remediation
| |
| arista 7020tra-48 | All versions |
CPE
Remediation
| |
| arista 7280cr-48 | All versions |
CPE
Remediation
| |
| arista 7280cr2-60 | All versions |
CPE
Remediation
| |
| arista 7280cr2a-30 | All versions |
CPE
Remediation
| |
| arista 7280cr2a-60 | All versions |
CPE
Remediation
| |
| arista 7280cr2k-30 | All versions |
CPE
Remediation
| |
| arista 7280cr2k-60 | All versions |
CPE
Remediation
| |
| arista 7280cr2m-30 | All versions |
CPE
Remediation
| |
| arista 7280cr3-32d4 | All versions |
CPE
Remediation
| |
| arista 7280cr3-32p4 | All versions |
CPE
Remediation
| |
| arista 7280cr3-36s | All versions |
CPE
Remediation
| |
| arista 7280cr3-96 | All versions |
CPE
Remediation
| |
| arista 7280cr3a-24d12 | All versions |
CPE
Remediation
| |
| arista 7280cr3a-48d6 | All versions |
CPE
Remediation
| |
| arista 7280cr3a-72 | All versions |
CPE
Remediation
| |
| arista 7280cr3ak-24d12 | All versions |
CPE
Remediation
| |
| arista 7280cr3ak-48d6 | All versions |
CPE
Remediation
| |
| arista 7280cr3ak-72 | All versions |
CPE
Remediation
| |
| arista 7280cr3am-24d12 | All versions |
CPE
Remediation
| |
| arista 7280cr3am-48d6 | All versions |
CPE
Remediation
| |
| arista 7280cr3am-72 | All versions |
CPE
Remediation
| |
| arista 7280cr3mk-32d4s | All versions |
CPE
Remediation
| |
| arista 7280cr3mk-32p4s | All versions |
CPE
Remediation
| |
| arista 7280dr3-24 | All versions |
CPE
Remediation
| |
| arista 7280dr3a-36 | All versions |
CPE
Remediation
| |
| arista 7280dr3a-54 | All versions |
CPE
Remediation
| |
| arista 7280dr3ak-36 | All versions |
CPE
Remediation
| |
| arista 7280dr3ak-54 | All versions |
CPE
Remediation
| |
| arista 7280dr3am-36 | All versions |
CPE
Remediation
| |
| arista 7280dr3am-54 | All versions |
CPE
Remediation
| |
| arista 7280pr3-24 | All versions |
CPE
Remediation
| |
| arista 7280qr-c36 | All versions |
CPE
Remediation
| |
| arista 7280qr-c36-m | All versions |
CPE
Remediation
| |
| arista 7280qr-c72 | All versions |
CPE
Remediation
| |
| arista 7280qra-c36s | All versions |
CPE
Remediation
| |
| arista 7280qra-c36sm | All versions |
CPE
Remediation
| |
| arista 7280sr-48c6 | All versions |
CPE
Remediation
| |
| arista 7280sr2-48yc6 | All versions |
CPE
Remediation
| |
| arista 7280sr2-48yc6-m | All versions |
CPE
Remediation
| |
| arista 7280sr2a-48yc6 | All versions |
CPE
Remediation
| |
| arista 7280sr2a-48yc6-m | All versions |
CPE
Remediation
| |
| arista 7280sr2k-48c6-m | All versions |
CPE
Remediation
| |
| arista 7280sr3-40yc6 | All versions |
CPE
Remediation
| |
| arista 7280sr3-48yc8 | All versions |
CPE
Remediation
| |
| arista 7280sr3m-48yc8 | All versions |
CPE
Remediation
| |
| arista 7280sra-48c6 | All versions |
CPE
Remediation
| |
| arista 7280sra-48c6-m | All versions |
CPE
Remediation
| |
| arista 7280sram-48c6 | All versions |
CPE
Remediation
| |
| arista 7280srm-40cx2 | All versions |
CPE
Remediation
| |
| arista 7280tr-48c6 | All versions |
CPE
Remediation
| |
| arista 7280tr3-40c6 | All versions |
CPE
Remediation
| |
| arista 7280tra-48c6 | All versions |
CPE
Remediation
| |
| arista 7280tra-48c6-m | All versions |
CPE
Remediation
| |
| arista 7289r3a-sc | All versions |
CPE
Remediation
| |
| arista 7289r3ak-sc | All versions |
CPE
Remediation
| |
| arista 7289r3am-sc | All versions |
CPE
Remediation
| |
| arista 7500r-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r-36q-lc | All versions |
CPE
Remediation
| |
| arista 7500r-48s2cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r-8cfpx-lc | All versions |
CPE
Remediation
| |
| arista 7500r2-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r2a-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r2ak-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r2ak-48ycq-lc | All versions |
CPE
Remediation
| |
| arista 7500r2am-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r2m-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7500r3-24d | All versions |
CPE
Remediation
| |
| arista 7500r3-24p | All versions |
CPE
Remediation
| |
| arista 7500r3-36cq | All versions |
CPE
Remediation
| |
| arista 7500r3k-36cq | All versions |
CPE
Remediation
| |
| arista 7500r3k-48y4d | All versions |
CPE
Remediation
| |
| arista 7500rm-36cq-lc | All versions |
CPE
Remediation
| |
| arista 7504r-fm | All versions |
CPE
Remediation
| |
| arista 7504r3 | All versions |
CPE
Remediation
| |
| arista 7508r-fm | All versions |
CPE
Remediation
| |
| arista 7508r3 | All versions |
CPE
Remediation
| |
| arista 7512r-fm | All versions |
CPE
Remediation
| |
| arista 7512r3 | All versions |
CPE
Remediation
| |
| arista 7516-sup2 | All versions |
CPE
Remediation
| |
| arista 7516n-ch | All versions |
CPE
Remediation
| |
| arista 7516r-fm | All versions |
CPE
Remediation
| |
| arista 7800r3-36d | All versions |
CPE
Remediation
| |
| arista 7800r3-48cq | All versions |
CPE
Remediation
| |
| arista 7800r3a-36d | All versions |
CPE
Remediation
| |
| arista 7800r3a-36dm | All versions |
CPE
Remediation
| |
| arista 7800r3a-36p | All versions |
CPE
Remediation
| |
| arista 7800r3a-36pm | All versions |
CPE
Remediation
| |
| arista 7800r3ak-36dm | All versions |
CPE
Remediation
| |
| arista 7800r3ak-36pm | All versions |
CPE
Remediation
| |
| arista 7800r3k-48cq | All versions |
CPE
Remediation
| |
| arista 7800r3k-48cqms | All versions |
CPE
Remediation
| |
| arista 7800r3k-72y | All versions |
CPE
Remediation
| |
| arista 7804r3 | All versions |
CPE
Remediation
| |
| arista 7808r3 | All versions |
CPE
Remediation
| |
| arista 7812r3 | All versions |
CPE
Remediation
| |
| arista 7816lr3 | All versions |
CPE
Remediation
| |
| arista 7816r3 | All versions |
CPE
Remediation
| |
Change History
7 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 9, 2026 | Initial Analysis | [email protected] |
| Jun 9, 2026 | CVE CISA KEV Update | Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government |
| Jun 9, 2026 | CVE Modified | CISA-ADP |
| Jun 8, 2026 | CVE Modified | CISA-ADP |
| Jun 5, 2026 | New CVE Received | [email protected] |