CVE-2026-7473

Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass

Published: Jun 5, 2026Updated: Jun 9, 2026 Sources: CVE List NVD BDUCWE-1023

5.8MEDIUM

Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

In plain language

AI Act now

Arista EOS switches with tunnel handling enabled are being actively attacked, so act now to stop untrusted network traffic from crossing into internal systems.

Executive summary

Unauthenticated network attackers can trigger unexpected tunnel decapsulation in Arista EOS when a packet matches a configured decapsulation IP, bypassing intended forwarding boundaries.

If affected, business impact

Network boundary bypassUnauthorized internal trafficAltered network communicationsOperational disruption

What to do now

Identify Arista EOS switches using VXLAN, decap-groups, or GRE tunnel interfaces, and record their configured tunnel destination addresses.
Apply access-control rules on upstream switches to allow only expected tunnel traffic to each tunnel destination address.
If upstream filtering is not possible, apply the vendor’s platform-specific access-control rules on the switch performing decapsulation.
Confirm the rules block unexpected tunnel protocols while allowing your approved tunnel traffic.
There is no fixed software version; Arista’s recommended resolution is the vendor mitigation guidance.

Patch / advisory Some work to apply

What is it

A switch that is meant to unwrap only approved types of network traffic can be tricked into accepting other traffic disguised for the same destination. It is like a receiving dock accepting a delivery through the secure entrance because the address matches, even though the delivery method was not approved; that traffic can then reach internal systems.

Who is affected

This matters to you if you run Arista EOS switches with VXLAN, decap-groups, or GRE tunnel interfaces configured. It is a risk when those tunnel decapsulation configurations are active and an attacker can send network packets to the configured decapsulation address.

How urgent is it

Attackers are already exploiting this weakness in the real world, and it is listed in CISA’s Known Exploited Vulnerabilities catalog. Treat the required traffic-filtering changes as an urgent network-security task and verify that unapproved tunnel traffic is blocked.

What to do — in detail

Inventory Arista EOS devices and identify every active VXLAN, decap-group, and GRE tunnel interface; document each configured decapsulation destination IP and the tunnel protocols, ports, and peers that are legitimate.
Confirm exposure by testing configuration and traffic paths: determine whether the device will receive externally sourced tunneled packets addressed to a configured decapsulation IP. Prioritize internet-facing, shared, and less-trusted network segments.
No fixed EOS version or software upgrade path is planned because an upgrade could disrupt existing deployment configurations. Use Arista’s mitigation guidance rather than targeting a release number.
Prefer upstream ACLs that permit only expected tunneled traffic, matching the tunnel destination IP, the appropriate IP next-protocol value, and where applicable the expected UDP destination port and source criteria.
If upstream ACLs cannot be deployed, use the decapsulation-switch ACL approach specified by Arista. The required ACL type varies by platform: some listed R-series platforms require MAC ACLs with UDF matching, while 7280R3 Series platforms use IP ACLs.
If a complete implementation must be delayed, temporarily restrict or remove reachability to tunnel destination IPs from untrusted networks, preserving only known tunnel peers.
CISA’s remediation due date was 2026-06-23. Validate the rules with approved tunnel traffic and blocked unexpected encapsulations, then review ACL deny events and forwarding telemetry for attempted unexpected tunnel protocols.

Technical context

CVE-2026-7473 has CVSS 5.8 (MEDIUM), with network attack vector, no privileges required, no user interaction, changed scope, and integrity impact. The weakness is CWE-1023: EOS can incorrectly decapsulate and forward a non-configured tunnel protocol when its destination IP matches a configured decapsulation IP for VXLAN, decap-groups, or GRE tunnel interfaces. Exploitation is confirmed in the wild; CISA added it to KEV on 2026-06-09. No public exploit code is on record. The vendor states that no software upgrade path is planned and recommends ACL-based mitigations.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:LAttack Complexity

Low

PR:NPrivileges Required

None

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:NConfidentiality

None

I:LIntegrity

Low

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-1023

Affected Products

Arista Networks, Inc.

commercial·USaka Arista Networks

Arista EOSOn-prem

Networking Infrastructure / router-switch

EOSOn-prem

Networking Infrastructure / router-switch

arista

commercial·US

eos

Networking Infrastructure

Exploitability

CISA Known Exploited Vulnerability

Added to KEV:Jun 9, 2026

Remediation due:Jun 23, 2026

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Official Patch Available

Workaround Available

Is your org exposed to CVE-2026-7473?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

References

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137

arista.com

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

arista.com

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473

cisa.gov

and 2 more references View all →

News mentions

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-7473 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows