Fixing and finding [Jump to remediation plan](#remediation) CVE ID # CVE-2026-7473 Published 2026-06-05 Updated 3 months ago Vendor/s Arista Product/s Extensible Operating System Version/s \* KEV Status Active Exploitation Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild. CVSS Score (v3.1) 5.8 / 10 Medium Severity Details Base score 5.8 Medium Attack vector Network Attack complexity Low Privileges required None User interaction None Scope Changed Confidentiality None Integrity Low Availability None Table of Contents [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) [Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources) ## Description CVE-2026-7473 is a medium-severity vulnerability in Arista EOS affecting tunnel decapsulation, currently exploited in the wild. ## Why this matters CVE-2026-7473 is a significant security concern because it is currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. While its CVSS score is 5.8 (Medium), the vulnerability allows Arista EOS switches to incorrectly decapsulate and forward unexpected tunneled traffic, such as VXLAN or GRE, without verifying the protocol type. This flaw can be leveraged by network-based attackers to bypass intended security boundaries or inject traffic into internal networks. Organizations using Arista EOS with tunnel configurations are at high risk and should prioritize remediation to prevent unauthorized data transit. ## CPE Arista | Product | Version Start | Version End (excl.) | Status | | ----------------- | ------------- | ------------------- | ---------- | | eos | \* | \* | vulnerable | | 7020sr-24c2 | - | - | unaffected | | 7020sr-32c2 | - | - | unaffected | | 7020srg-24c2 | - | - | unaffected | | 7020tr-48 | - | - | unaffected | | 7020tra-48 | - | - | unaffected | | 7280cr-48 | - | - | unaffected | | 7280cr2-60 | - | - | unaffected | | 7280cr2a-30 | - | - | unaffected | | 7280cr2a-60 | - | - | unaffected | | 7280cr2k-30 | - | - | unaffected | | 7280cr2k-60 | - | - | unaffected | | 7280cr2m-30 | - | - | unaffected | | 7280cr3-32d4 | - | - | unaffected | | 7280cr3-32p4 | - | - | unaffected | | 7280cr3-36s | - | - | unaffected | | 7280cr3-96 | - | - | unaffected | | 7280cr3a-24d12 | - | - | unaffected | | 7280cr3a-48d6 | - | - | unaffected | | 7280cr3a-72 | - | - | unaffected | | 7280cr3ak-24d12 | - | - | unaffected | | 7280cr3ak-48d6 | - | - | unaffected | | 7280cr3ak-72 | - | - | unaffected | | 7280cr3am-24d12 | - | - | unaffected | | 7280cr3am-48d6 | - | - | unaffected | | 7280cr3am-72 | - | - | unaffected | | 7280cr3mk-32d4s | - | - | unaffected | | 7280cr3mk-32p4s | - | - | unaffected | | 7280dr3-24 | - | - | unaffected | | 7280dr3a-36 | - | - | unaffected | | 7280dr3a-54 | - | - | unaffected | | 7280dr3ak-36 | - | - | unaffected | | 7280dr3ak-54 | - | - | unaffected | | 7280dr3am-36 | - | - | unaffected | | 7280dr3am-54 | - | - | unaffected | | 7280pr3-24 | - | - | unaffected | | 7280qr-c36 | - | - | unaffected | | 7280qr-c36-m | - | - | unaffected | | 7280qr-c72 | - | - | unaffected | | 7280qra-c36s | - | - | unaffected | | 7280qra-c36sm | - | - | unaffected | | 7280sr-48c6 | - | - | unaffected | | 7280sr2-48yc6 | - | - | unaffected | | 7280sr2-48yc6-m | - | - | unaffected | | 7280sr2a-48yc6 | - | - | unaffected | | 7280sr2a-48yc6-m | - | - | unaffected | | 7280sr2k-48c6-m | - | - | unaffected | | 7280sr3-40yc6 | - | - | unaffected | | 7280sr3-48yc8 | - | - | unaffected | | 7280sr3m-48yc8 | - | - | unaffected | | 7280sra-48c6 | - | - | unaffected | | 7280sra-48c6-m | - | - | unaffected | | 7280sram-48c6 | - | - | unaffected | | 7280srm-40cx2 | - | - | unaffected | | 7280tr-48c6 | - | - | unaffected | | 7280tr3-40c6 | - | - | unaffected | | 7280tra-48c6 | - | - | unaffected | | 7280tra-48c6-m | - | - | unaffected | | 7289r3a-sc | - | - | unaffected | | 7289r3ak-sc | - | - | unaffected | | 7289r3am-sc | - | - | unaffected | | 7500r-36cq-lc | - | - | unaffected | | 7500r-36q-lc | - | - | unaffected | | 7500r-48s2cq-lc | - | - | unaffected | | 7500r-8cfpx-lc | - | - | unaffected | | 7500r2-36cq-lc | - | - | unaffected | | 7500r2a-36cq-lc | - | - | unaffected | | 7500r2ak-36cq-lc | - | - | unaffected | | 7500r2ak-48ycq-lc | - | - | unaffected | | 7500r2am-36cq-lc | - | - | unaffected | | 7500r2m-36cq-lc | - | - | unaffected | | 7500r3-24d | - | - | unaffected | | 7500r3-24p | - | - | unaffected | | 7500r3-36cq | - | - | unaffected | | 7500r3k-36cq | - | - | unaffected | | 7500r3k-48y4d | - | - | unaffected | | 7500rm-36cq-lc | - | - | unaffected | | 7504r-fm | - | - | unaffected | | 7504r3 | - | - | unaffected | | 7508r-fm | - | - | unaffected | | 7508r3 | - | - | unaffected | | 7512r-fm | - | - | unaffected | | 7512r3 | - | - | unaffected | | 7516-sup2 | - | - | unaffected | | 7516n-ch | - | - | unaffected | | 7516r-fm | - | - | unaffected | | 7800r3-36d | - | - | unaffected | | 7800r3-48cq | - | - | unaffected | | 7800r3a-36d | - | - | unaffected | | 7800r3a-36dm | - | - | unaffected | | 7800r3a-36p | - | - | unaffected | | 7800r3a-36pm | - | - | unaffected | | 7800r3ak-36dm | - | - | unaffected | | 7800r3ak-36pm | - | - | unaffected | | 7800r3k-48cq | - | - | unaffected | | 7800r3k-48cqms | - | - | unaffected | | 7800r3k-72y | - | - | unaffected | | 7804r3 | - | - | unaffected | | 7808r3 | - | - | unaffected | | 7812r3 | - | - | unaffected | | 7816lr3 | - | - | unaffected | | 7816r3 | - | - | unaffected | ## Related weakness (CWE) CWE-1023 ## Remediation plan 1 ### Apply official patches Consult Arista Security Advisory 0137 and apply the recommended software patches or hotfixes provided by the vendor to address the tunnel decapsulation logic error. 2 ### Update affected systems Upgrade Arista Extensible Operating System (EOS) to the latest maintained release versions that include the fix for CVE-2026-7473 across all vulnerable hardware platforms. 3 ### Restrict access Implement Control Plane ACLs (CPACLs) to restrict traffic destined for decapsulation IP addresses to only authorized tunnel sources and expected protocols. 4 ### Monitor for exploitation Enable logging for tunnel interfaces and monitor for unexpected protocol types or malformed encapsulated packets targeting the switch's decapsulation IP addresses. ## Detection Guidance To detect potential exploitation, security teams should monitor network traffic for packets with unexpected protocol types (e.g., non-standard GRE or VXLAN) destined for configured decapsulation IP addresses. Analyze flow logs for unusual internal traffic originating from tunnel endpoints. Implement IDS/IPS signatures that flag misaligned tunnel headers or unauthorized decapsulation attempts. Reviewing Arista EOS logs for unexpected decapsulation events can also help identify malicious activity. ## References [https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 Broken Link ](https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137)[https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 Mitigation Vendor Advisory ](https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-7473 US Government Resource](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473) ## Sources NIST National Vulnerability Database (NVD) CISA Known Exploited Vulnerabilities (KEV) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](https://www.upguard.com/contact-sales) [Free trial](https://www.upguard.com/demo)