Vulnerability Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arista | Eos | All versions |
| Arista | 7020Sr-24C2 | - |
| Arista | 7020Sr-32C2 | - |
| Arista | 7020Srg-24C2 | - |
| Arista | 7020Tr-48 | - |
| Arista | 7020Tra-48 | - |
| Arista | 7280Cr-48 | - |
| Arista | 7280Cr2-60 | - |
| Arista | 7280Cr2A-30 | - |
| Arista | 7280Cr2A-60 | - |
| Arista | 7280Cr2K-30 | - |
| Arista | 7280Cr2K-60 | - |
| Arista | 7280Cr2M-30 | - |
| Arista | 7280Cr3-32D4 | - |
| Arista | 7280Cr3-32P4 | - |
| Arista | 7280Cr3-36S | - |
| Arista | 7280Cr3-96 | - |
| Arista | 7280Cr3A-24D12 | - |
| Arista | 7280Cr3A-48D6 | - |
| Arista | 7280Cr3A-72 | - |
Related Weaknesses (CWE)
References
- https://www.arista.com/en/support/advisories-notices/security-advisory/22872-secBroken Link
- https://www.arista.com/en/support/advisories-notices/security-advisory/24005-secMitigationVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
FAQ
What is CVE-2026-7473?
CVE-2026-7473 is a vulnerability with a CVSS score of 5.8 (MEDIUM). On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is p...
How severe is CVE-2026-7473?
CVE-2026-7473 has been rated MEDIUM with a CVSS base score of 5.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-7473?
Check the references section above for vendor advisories and patch information. Affected products include: Arista Eos, Arista 7020Sr-24C2, Arista 7020Sr-32C2, Arista 7020Srg-24C2, Arista 7020Tr-48.