CVE-2026-7473

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

Exploited in the wild. In CISA KEV since 2026‑06‑09. A vendor fix is available.

CVSS 3.15.8Medium EPSS percentile49th0.6% chance in 30 days CISA KEVListedsince 2026-06-09, due 2026-06-23
No public exploit known FixVendor fixNo build named by the sources

Published 2026-06-05Updated 2026-06-09Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Identify Arista EOS switches using VXLAN, decap-groups, or GRE tunnel interfaces, and record their configured tunnel destination addresses.
Apply access-control rules on upstream switches to allow only expected tunnel traffic to each tunnel destination address.
If upstream filtering is not possible, apply the vendor’s platform-specific access-control rules on the switch performing decapsulation.
Confirm the rules block unexpected tunnel protocols while allowing your approved tunnel traffic.
There is no fixed software version; Arista’s recommended resolution is the vendor mitigation guidance.

Vendor advisory Some work to apply

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

In plain language

Written by AI from the record

Arista EOS switches with tunnel handling enabled are being actively attacked, so act now to stop untrusted network traffic from crossing into internal systems.

Unauthenticated network attackers can trigger unexpected tunnel decapsulation in Arista EOS when a packet matches a configured decapsulation IP, bypassing intended forwarding boundaries.

If you're affected

Network boundary bypass
Unauthorized internal traffic
Altered network communications
Operational disruption

What is it

A switch that is meant to unwrap only approved types of network traffic can be tricked into accepting other traffic disguised for the same destination. It is like a receiving dock accepting a delivery through the secure entrance because the address matches, even though the delivery method was not approved; that traffic can then reach internal systems.

Who is affected

This matters to you if you run Arista EOS switches with VXLAN, decap-groups, or GRE tunnel interfaces configured. It is a risk when those tunnel decapsulation configurations are active and an attacker can send network packets to the configured decapsulation address.

How urgent is it

Attackers are already exploiting this weakness in the real world, and it is listed in CISA’s Known Exploited Vulnerabilities catalog. Treat the required traffic-filtering changes as an urgent network-security task and verify that unapproved tunnel traffic is blocked.

What to do — in detail

Inventory Arista EOS devices and identify every active VXLAN, decap-group, and GRE tunnel interface; document each configured decapsulation destination IP and the tunnel protocols, ports, and peers that are legitimate.
Confirm exposure by testing configuration and traffic paths: determine whether the device will receive externally sourced tunneled packets addressed to a configured decapsulation IP. Prioritize internet-facing, shared, and less-trusted network segments.
No fixed EOS version or software upgrade path is planned because an upgrade could disrupt existing deployment configurations. Use Arista’s mitigation guidance rather than targeting a release number.
Prefer upstream ACLs that permit only expected tunneled traffic, matching the tunnel destination IP, the appropriate IP next-protocol value, and where applicable the expected UDP destination port and source criteria.
If upstream ACLs cannot be deployed, use the decapsulation-switch ACL approach specified by Arista. The required ACL type varies by platform: some listed R-series platforms require MAC ACLs with UDF matching, while 7280R3 Series platforms use IP ACLs.
If a complete implementation must be delayed, temporarily restrict or remove reachability to tunnel destination IPs from untrusted networks, preserving only known tunnel peers.
CISA’s remediation due date was 2026-06-23. Validate the rules with approved tunnel traffic and blocked unexpected encapsulations, then review ACL deny events and forwarding telemetry for attempted unexpected tunnel protocols.

Technical context

CVE-2026-7473 has CVSS 5.8 (MEDIUM), with network attack vector, no privileges required, no user interaction, changed scope, and integrity impact. The weakness is CWE-1023: EOS can incorrectly decapsulate and forward a non-configured tunnel protocol when its destination IP matches a configured decapsulation IP for VXLAN, decap-groups, or GRE tunnel interfaces. Exploitation is confirmed in the wild; CISA added it to KEV on 2026-06-09. No public exploit code is on record. The vendor states that no software upgrade path is planned and recommends ACL-based mitigations.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS49th

CISA KEV

Listed as exploited in the wild since 2026-06-09.

US federal agencies must remediate by 2026-06-23.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 49th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by in-the-wild reports.

Lifecycle

7 events over 20 days, from the signal feeds we watch.

2026-06-25OpenVAS check added
2026-06-09Added to CISA KEVpatch available, workaround available, record updated
2026-06-05Publishedweakness classified

Affected products

Arista Networks, Inc.commercial · USaka Arista Networks
- Arista EOSOn-premNetworking Infrastructure / router-switch
- EOSOn-premNetworking Infrastructure / router-switch
aristacommercial · US
- eosNetworking Infrastructure

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N

Scored 5.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation