CVE-2026-7473 KEV
5.8
MEDIUM · CVSS 3.1 · EPSS 0.6% (pctl 49)
Patch first
On CISA KEV — known exploited in the wild, due 2026-06-23.
Description
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
Scoring
| CVSS | 5.8 (MEDIUM, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
| EPSS | 0.65% — more likely to be exploited than 49% of all CVEs |
| Weakness | CWE-1023 |
| On CISA KEV | yes — remediate by 2026-06-23 |
| Public exploit | none known |
| Published | 2026-06-05 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability |
|---|---|
| Added | 2026-06-09 |
| Due | 2026-06-23 |
| Vendor / product | Arista / Extensible Operating System |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| arista | 7020sr-24c2 |
| arista | 7020sr-32c2 |
| arista | 7020srg-24c2 |
| arista | 7020tr-48 |
| arista | 7020tra-48 |
| arista | 7280cr-48 |
| arista | 7280cr2-60 |
| arista | 7280cr2a-30 |
| arista | 7280cr2a-60 |
| arista | 7280cr2k-30 |
| arista | 7280cr2k-60 |
| arista | 7280cr2m-30 |
| arista | 7280cr3-32d4 |
| arista | 7280cr3-32p4 |
| arista | 7280cr3-36s |
| arista | 7280cr3-96 |
| arista | 7280cr3a-24d12 |
| arista | 7280cr3a-48d6 |
| arista | 7280cr3a-72 |
| arista | 7280cr3ak-24d12 |
| arista | 7280cr3ak-48d6 |
| arista | 7280cr3ak-72 |
| arista | 7280cr3am-24d12 |
| arista | 7280cr3am-48d6 |
| arista | 7280cr3am-72 |
| arista | 7280cr3mk-32d4s |
| arista | 7280cr3mk-32p4s |
| arista | 7280dr3-24 |
| arista | 7280dr3a-36 |
| arista | 7280dr3a-54 |
| arista | 7280dr3ak-36 |
| arista | 7280dr3ak-54 |
| arista | 7280dr3am-36 |
| arista | 7280dr3am-54 |
| arista | 7280pr3-24 |
| arista | 7280qr-c36 |
| arista | 7280qr-c36-m |
| arista | 7280qr-c72 |
| arista | 7280qra-c36s |
| arista | eos |
References
→ the Explorer · watch your stack · NVD