Medium 5.8Known exploited (CISA KEV)Published Jun 5, 2026

CVE-2026-7473Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

Updated under an hour ago (2026-10-19 09:00 UTC)

Does this affect you?

It affects Arista Networks EOS and 1 other product. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Jun 9, 2026; federal agencies had to remediate by Jun 23, 2026. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Arista Networks EOS

Exploited in the last 30 days

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

CVSS: 5.8 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Weakness (CWE): CWE-1023
Known exploited: Added to CISA KEV Jun 9, 2026; federal remediation due Jun 23, 2026Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 0.65% (percentile 50)
Assigned by: Arista
NVD analysis: Analyzed
Record last updated: Oct 7, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Arista Networks EOS arista_networks:eos (from the name)	4.36.0; from 4.35.0 through 4.35; from 4.34.0 through 4.34; from 4.33.0 through 4.33; from 4.32.0 through 4.32; from 4.31.0 through 4.31; through 4.30	CNA record
arista eos arista:eos	all versions	NVD

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137vendor-advisory, broken-link
https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137mitigation, vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.