{"id":"CVE-2026-7473","aliases":["EUVD-2026-34858","GHSA-mcx4-vm6v-r473"],"status":"published","title":"Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01108,"percentile":0.66288,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-1023"],"published":"2026-06-05T16:22:47Z","modified":"2026-10-25T23:10:00Z","kev":{"date_added":"2026-06-09","due_date":"2026-06-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-06-09"},{"source":"kev","since":"2026-06-09"}],"exploits":[{"source":"pocgithub","id":"fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","title":"fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","date":"2026-06-10","url":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass"}],"products":[{"vendor":"arista","product":"eos"},{"vendor":"arista","product":"extensible operating system"},{"vendor":"arista networks","product":"eos"}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137","tags":["vendor-advisory","Broken Link"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","tags":["vendor-advisory","Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7473"},{"url":"https://github.com/advisories/GHSA-mcx4-vm6v-r473"}],"sources":{"cve":[{"id":"CVE-2026-7473","title":"Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","status":"published","published":"2026-06-05T16:22:47.989Z","modified":"2026-10-07T18:27:31.678Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T14:20:06.216584Z"}],"euvd":[{"id":"EUVD-2026-34858","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","status":"published","published":"2026-06-05T16:22:47Z","modified":"2026-10-07T18:27:31Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"exploited_since":"2026-06-09","updated_at":"2026-11-02T17:27:34.353796Z"}],"ghsa":[{"id":"GHSA-mcx4-vm6v-r473","title":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN...","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","status":"published","published":"2026-06-05T18:31:40Z","modified":"2026-06-09T18:30:34Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T15:08:40.95868Z"}],"kev":[{"id":"CVE-2026-7473","title":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","description":"Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.","cwes":["CWE-1023"],"kev":{"date_added":"2026-06-09","due_date":"2026-06-23","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2026-7473","description":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","status":"published","published":"2026-06-05T17:17:02.85Z","modified":"2026-10-25T23:10:00.167Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-1023"],"updated_at":"2026-11-02T14:12:22.371367Z"}]}}