CVE-2026-7473
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Description
CVE-2026-7473 is a medium-severity vulnerability in Arista EOS (Extensible Operating System) affecting platforms configured for tunnel decapsulation, such as VXLAN, decap-groups, or a GRE tunnel interface. On affected switches, traffic destined to the configured decapsulation IP is decapsulated and forwarded even when it does not match the intended tunnel protocol, because the switch does not verify the tunnel protocol type. This lets an attacker send unexpected tunneled packets that the switch incorrectly processes and forwards, potentially injecting traffic into segments it should not reach. CVE-2026-7473 is rated CVSS 5.8 (Medium) with a changed scope, is listed in the CISA KEV catalog, and has been reported as exploited in the wild. Arista EOS operators using tunnel decapsulation should apply the vendor mitigation promptly.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| arista | eos | All versions |
References
- https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137(Broken Link)
- https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473(US Government Resource)
Weakness Type
CWE-1023: Incomplete Comparison with Missing Factors
CVE-2026-7473 is classified under CWE-1023 — Incomplete Comparison with Missing Factors. When deciding whether to decapsulate a packet, the switch compares only the destination IP against its configured decapsulation IP and omits a necessary factor: the tunnel protocol type. Because this security-relevant check is incomplete, packets that should not be decapsulated are accepted and forwarded.
Learn more: CWE-1023 — Incomplete Comparison with Missing Factors
Impact Analysis
CVE-2026-7473 carries a CVSS 3.1 base score of 5.8 (Medium). Attack Vector (Network): the malicious packets are sent over the network to the switch's decapsulation IP. Attack Complexity (Low): no special conditions are required. Privileges Required (None) and User Interaction (None): the attacker needs no credentials and no victim action. Scope (Changed): the impact extends beyond the switch itself to the network segments behind it, which is why a relatively contained flaw still scores in the medium range. Integrity (Low) with Confidentiality (None) and Availability (None): the practical effect is unauthorized processing and forwarding of unexpected tunneled traffic, which can let an attacker inject packets into networks they should not reach, while data disclosure and outright denial of service are not the primary impact. Despite a low EPSS score (about 0.4%), the vulnerability is reported as exploited in the wild, so it should not be dismissed on the basis of its medium rating.
Exploit Maturity
CISA has added CVE-2026-7473 to the Known Exploited Vulnerabilities catalog, and the NVD description states the issue has been reported as exploited in the wild. The references list the Arista vendor advisory and the KEV entry, with no public exploit code linked, and the EPSS score is low at about 0.4% (29th percentile). Even so, the report of real-world exploitation outweighs the modest EPSS figure, and affected operators should apply the mitigation promptly.
Remediation
- Follow CISA's required action and apply the mitigation and fixed software documented in the Arista security advisory for CVE-2026-7473.
- Identify switches configured for tunnel decapsulation (VXLAN, decap-groups, or GRE tunnel interfaces), as these are the systems exposed to the flaw.
- As an interim mitigation, apply the vendor-recommended configuration controls and restrict which sources can send traffic to the configured decapsulation IP using access control lists.
- Monitor for unexpected decapsulated or forwarded traffic and review flow records for packets that should not have crossed segment boundaries.
- As long-term hardening, ensure tunnel-handling logic validates all relevant factors — including the tunnel protocol type — before decapsulating and forwarding (per the CWE-1023 guidance).
Technical Details
The flaw is an incomplete comparison (CWE-1023): Arista EOS decides to decapsulate based on a destination-IP match with the configured decapsulation IP but fails to also verify the tunnel protocol type, so the comparison is missing a security-relevant factor. As reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, an attacker on the network sends crafted packets whose destination matches the decapsulation IP but whose tunnel type is not the configured one; the switch decapsulates and forwards them anyway. The changed scope captures that the mis-forwarded traffic affects resources beyond the switch — the downstream network segments — which is the core integrity concern.
Frequently Asked Questions
Is CVE-2026-7473 being actively exploited?
Yes. CVE-2026-7473 is listed in CISA's Known Exploited Vulnerabilities catalog, and it has been reported as exploited in the wild. Its EPSS score is low (about 0.4%), but the in-the-wild report is the more important signal.
What products are affected by CVE-2026-7473?
Arista EOS (Extensible Operating System) is affected on platforms configured for tunnel decapsulation, including VXLAN, decap-groups, or GRE tunnel interfaces.
How do I fix CVE-2026-7473?
Apply the mitigation and fixed software documented in the Arista security advisory for CVE-2026-7473, and restrict which sources can send traffic to the configured decapsulation IP in the meantime.
How severe is CVE-2026-7473?
It is rated Medium with a CVSS 3.1 base score of 5.8 and a changed scope. The impact is limited integrity (unexpected traffic decapsulation and forwarding) rather than data theft or outage, but because it is reported as exploited in the wild, it warrants prompt mitigation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.