CVE-2026-7473

Arista EOS switches configured for tunnel decapsulation — VXLAN, decap-groups, or a GRE tunnel interface — fail to verify the tunnel protocol type of incoming packets before decapsulating them (CWE-1023, incomplete comparison with missing factors). An attacker can send an unexpected type of tunneled packet whose destination IP matches the switch's configured decapsulation IP, causing the switch to incorrectly decapsulate and forward it as if it belonged to the configured tunnel. The result is a traffic-integrity problem — packets are processed and delivered through a path they were never intended for — reflected in the CVSS 4.0 score of 6.9 as network-triggered, unauthenticated, integrity-only impact with no confidentiality or availability loss. Only deployments running Arista EOS with a tunnel decapsulation configuration are affected; sites without VXLAN/decap-group/GRE decapsulation are not exposed to this flaw. Exploitation in the wild has been reported — CISA added the issue to the Known Exploited Vulnerabilities catalog on 2026-06-09 — though no public proof-of-concept is known and ransomware use has not been confirmed.

What to do: Inventory Arista EOS devices for tunnel decapsulation configuration (VXLAN, decap-groups, or GRE tunnel interfaces) and check whether the configured decapsulation IP is reachable from untrusted networks. Upgrade to a fixed EOS release per Arista's advisory for CVE-2026-7473 (fixed versions are not specified in the available data) or apply the vendor's recommended mitigation, such as filtering unexpected tunnel traffic destined to the decapsulation IP; federal agencies must remediate within the BOD 22-01 timeline following the 2026-06-09 KEV addition. Because the scored impact is limited to traffic-handling integrity, prioritize the exposure assessment, but do not defer patching given confirmed in-the-wild exploitation.