CVE-2026-7473: Arista EOS Tunnel Decapsulation Spoofing (KEV)

CVE-2026-7473 is a tunnel-decapsulation flaw (CWE-1023) in Arista EOS that lets an attacker smuggle unexpected tunneled packets past a switch's VXLAN, decap-group or GRE decapsulation logic because the switch never checks the actual tunnel protocol type; Arista has stated no software fix is planned and offers only an ACL-based workaround, while CISA's KEV entry confirms it has been exploited in the wild.

CVE-2026-7473 (CWE-1023, Incomplete Comparison with Missing Factors) affects Arista EOS on platforms with a tunnel-decapsulation feature configured — VXLAN, decap-groups, or a GRE tunnel interface. NVD's description states: "the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type," and explicitly adds: "This issue has been reported as being exploited in the wild" (NVD).

NVD's vulnerability status is "Analyzed," but the only CVSS metrics on record are Arista's own CNA-submitted Secondary scores: CVSS v3.1 5.8 (medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, and CVSS v4.0 6.9 (medium), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N — network-reachable, low attack complexity, no authentication, with a changed scope but only limited integrity impact and no confidentiality or availability impact. Neither is an NVD Primary (independently NVD-confirmed) score, and neither vector's Exploit Maturity field is set, even though NVD's plain-text description separately confirms exploitation in the wild (NVD).

Arista's own security advisory lists the affected platform families as the 7020R series, 7280R/R2 series, 7500R/R2 series, and (with more limited IP-in-IPv6/GUEv6 exposure) the 7280R3, 7500R3 and 7800R3 series, across EOS release trains 4.30.x through 4.36.x; a long list of fixed-function and cloud-hosted EOS platforms are explicitly listed as not affected. Critically, the advisory states: "No software upgrade path is planned to address this issue due to the risk of breaking existing configuration on deployments." Instead, Arista recommends either upstream ACLs that permit only legitimate tunnel protocols to the decapsulation IP, or device-local MAC ACLs (7020R/7280R/7500R) or IPv6 ACLs using User-Defined Fields (7280R3/7500R3/7800R3) — while cautioning that applying a new ACL/TCAM profile is itself "a disruptive operation that could impact traffic forwarding" (Arista Security Advisory 0137).

CISA added CVE-2026-7473 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-06-09, with a required-action due date of 2026-06-23 — a longer-than-typical two-week window consistent with a fix that requires disruptive, network-specific ACL reconfiguration rather than a simple software patch — and lists known ransomware campaign use as "Unknown" (catalog membership confirmed this run by exact cveID match against the raw KEV feed) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at only 0.01108 (65.788th percentile) — a striking contrast with both NVD's and Arista's own confirmation of in-the-wild exploitation, illustrating that a generic EPSS score can understate risk for a niche, workaround-only networking-hardware flaw that KEV and vendor telemetry already confirm is being actively abused (FIRST EPSS).

Because there is no patched EOS release to install, any affected 7020R/7280R/7500R/7800R3 switch with VXLAN, decap-groups or GRE tunnel decapsulation configured should have upstream or device-local ACLs applied per Arista's advisory as soon as a maintenance window allows, with the understanding that the ACL/TCAM change itself can briefly disrupt traffic forwarding.

• Arista EOS switches with VXLAN/decap-group/GRE tunnel decapsulation configured incorrectly decapsulate and forward unexpected tunneled packets because the tunnel protocol type is not verified; NVD states this has been reported as exploited in the wild. — NVD
• Only CVSS metrics on record are Arista's own Secondary scores: v3.1 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) and v4.0 6.9; no NVD Primary score published. — NVD
• Affected: 7020R, 7280R/R2, 7500R/R2 series fully, 7280R3/7500R3/7800R3 with limited exposure, on EOS 4.30.x-4.36.x; no software fix is planned; mitigation is upstream ACLs or device-local MAC/IPv6 ACLs via User-Defined Fields, noted as a potentially disruptive change. — Arista Security Advisory 0137
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-06-09, required-action due date 2026-06-23, ransomware campaign use listed as Unknown; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.01108 (65.788th percentile) as of 2026-10-29. — FIRST EPSS