CVE-2026-7473
Description
CVE-2026-7473 is a medium-severity vulnerability in Arista EOS affecting tunnel decapsulation, currently exploited in the wild.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| eos | * | * | vulnerable |
| 7020sr-24c2 | - | - | unaffected |
| 7020sr-32c2 | - | - | unaffected |
| 7020srg-24c2 | - | - | unaffected |
| 7020tr-48 | - | - | unaffected |
| 7020tra-48 | - | - | unaffected |
| 7280cr-48 | - | - | unaffected |
| 7280cr2-60 | - | - | unaffected |
| 7280cr2a-30 | - | - | unaffected |
| 7280cr2a-60 | - | - | unaffected |
| 7280cr2k-30 | - | - | unaffected |
| 7280cr2k-60 | - | - | unaffected |
| 7280cr2m-30 | - | - | unaffected |
| 7280cr3-32d4 | - | - | unaffected |
| 7280cr3-32p4 | - | - | unaffected |
| 7280cr3-36s | - | - | unaffected |
| 7280cr3-96 | - | - | unaffected |
| 7280cr3a-24d12 | - | - | unaffected |
| 7280cr3a-48d6 | - | - | unaffected |
| 7280cr3a-72 | - | - | unaffected |
| 7280cr3ak-24d12 | - | - | unaffected |
| 7280cr3ak-48d6 | - | - | unaffected |
| 7280cr3ak-72 | - | - | unaffected |
| 7280cr3am-24d12 | - | - | unaffected |
| 7280cr3am-48d6 | - | - | unaffected |
| 7280cr3am-72 | - | - | unaffected |
| 7280cr3mk-32d4s | - | - | unaffected |
| 7280cr3mk-32p4s | - | - | unaffected |
| 7280dr3-24 | - | - | unaffected |
| 7280dr3a-36 | - | - | unaffected |
| 7280dr3a-54 | - | - | unaffected |
| 7280dr3ak-36 | - | - | unaffected |
| 7280dr3ak-54 | - | - | unaffected |
| 7280dr3am-36 | - | - | unaffected |
| 7280dr3am-54 | - | - | unaffected |
| 7280pr3-24 | - | - | unaffected |
| 7280qr-c36 | - | - | unaffected |
| 7280qr-c36-m | - | - | unaffected |
| 7280qr-c72 | - | - | unaffected |
| 7280qra-c36s | - | - | unaffected |
| 7280qra-c36sm | - | - | unaffected |
| 7280sr-48c6 | - | - | unaffected |
| 7280sr2-48yc6 | - | - | unaffected |
| 7280sr2-48yc6-m | - | - | unaffected |
| 7280sr2a-48yc6 | - | - | unaffected |
| 7280sr2a-48yc6-m | - | - | unaffected |
| 7280sr2k-48c6-m | - | - | unaffected |
| 7280sr3-40yc6 | - | - | unaffected |
| 7280sr3-48yc8 | - | - | unaffected |
| 7280sr3m-48yc8 | - | - | unaffected |
| 7280sra-48c6 | - | - | unaffected |
| 7280sra-48c6-m | - | - | unaffected |
| 7280sram-48c6 | - | - | unaffected |
| 7280srm-40cx2 | - | - | unaffected |
| 7280tr-48c6 | - | - | unaffected |
| 7280tr3-40c6 | - | - | unaffected |
| 7280tra-48c6 | - | - | unaffected |
| 7280tra-48c6-m | - | - | unaffected |
| 7289r3a-sc | - | - | unaffected |
| 7289r3ak-sc | - | - | unaffected |
| 7289r3am-sc | - | - | unaffected |
| 7500r-36cq-lc | - | - | unaffected |
| 7500r-36q-lc | - | - | unaffected |
| 7500r-48s2cq-lc | - | - | unaffected |
| 7500r-8cfpx-lc | - | - | unaffected |
| 7500r2-36cq-lc | - | - | unaffected |
| 7500r2a-36cq-lc | - | - | unaffected |
| 7500r2ak-36cq-lc | - | - | unaffected |
| 7500r2ak-48ycq-lc | - | - | unaffected |
| 7500r2am-36cq-lc | - | - | unaffected |
| 7500r2m-36cq-lc | - | - | unaffected |
| 7500r3-24d | - | - | unaffected |
| 7500r3-24p | - | - | unaffected |
| 7500r3-36cq | - | - | unaffected |
| 7500r3k-36cq | - | - | unaffected |
| 7500r3k-48y4d | - | - | unaffected |
| 7500rm-36cq-lc | - | - | unaffected |
| 7504r-fm | - | - | unaffected |
| 7504r3 | - | - | unaffected |
| 7508r-fm | - | - | unaffected |
| 7508r3 | - | - | unaffected |
| 7512r-fm | - | - | unaffected |
| 7512r3 | - | - | unaffected |
| 7516-sup2 | - | - | unaffected |
| 7516n-ch | - | - | unaffected |
| 7516r-fm | - | - | unaffected |
| 7800r3-36d | - | - | unaffected |
| 7800r3-48cq | - | - | unaffected |
| 7800r3a-36d | - | - | unaffected |
| 7800r3a-36dm | - | - | unaffected |
| 7800r3a-36p | - | - | unaffected |
| 7800r3a-36pm | - | - | unaffected |
| 7800r3ak-36dm | - | - | unaffected |
| 7800r3ak-36pm | - | - | unaffected |
| 7800r3k-48cq | - | - | unaffected |
| 7800r3k-48cqms | - | - | unaffected |
| 7800r3k-72y | - | - | unaffected |
| 7804r3 | - | - | unaffected |
| 7808r3 | - | - | unaffected |
| 7812r3 | - | - | unaffected |
| 7816lr3 | - | - | unaffected |
| 7816r3 | - | - | unaffected |
Related weakness (CWE)
Remediation plan
Apply official patches
Consult Arista Security Advisory 0137 and apply the recommended software patches or hotfixes provided by the vendor to address the tunnel decapsulation logic error.
Update affected systems
Upgrade Arista Extensible Operating System (EOS) to the latest maintained release versions that include the fix for CVE-2026-7473 across all vulnerable hardware platforms.
Restrict access
Implement Control Plane ACLs (CPACLs) to restrict traffic destined for decapsulation IP addresses to only authorized tunnel sources and expected protocols.
Monitor for exploitation
Enable logging for tunnel interfaces and monitor for unexpected protocol types or malformed encapsulated packets targeting the switch's decapsulation IP addresses.
Detection Guidance
To detect potential exploitation, security teams should monitor network traffic for packets with unexpected protocol types (e.g., non-standard GRE or VXLAN) destined for configured decapsulation IP addresses. Analyze flow logs for unusual internal traffic originating from tunnel endpoints. Implement IDS/IPS signatures that flag misaligned tunnel headers or unauthorized decapsulation attempts. Reviewing Arista EOS logs for unexpected decapsulation events can also help identify malicious activity.