CVE-2026-7473

CVE-2026-7473 is a medium-severity (CVSS 5.8) vulnerability in Arista Extensible Operating System. CISA added it to the Known Exploited Vulnerabilities catalog on June 9, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 23, 2026. CISA does not currently list it as used in ransomware campaigns. Arista has 3 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

• https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137
• https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473