Actively exploited · Published Jun 5, 2026 · Assigned by Arista
CVE-2026-7473Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass
Medium 5.8 Exploited
In plain English
A medium-severity security flaw in EOS from Arista Networks. Attackers are actively exploiting it in the wild (listed by CISA on June 9, 2026). The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Jun 23, 2026.
Official description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Arista Networks | EOS | 4.36.04.35.0 – through 4.354.34.0 – through 4.344.33.0 – through 4.334.32.0 – through 4.324.31.0 – through 4.31* – through 4.30 |
Weakness: CWE-1023 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
References
- https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137 vendor-advisory
- https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473 government-resource