CVE-2026-7473: Arista EOS Tunnel Decapsulation Protocol Validation Bypass

Technical summary

The vulnerability affects Arista EOS platforms with active tunnel decapsulation configurations. When a switch is configured to decapsulate specific tunnel types (VXLAN, GRE, or decap-groups), it validates that inbound packets match the destination IP of the decapsulation interface but fails to verify the tunnel protocol type. An attacker can send specially crafted packets with a destination IP matching the configured decapsulation endpoint but using a different or unexpected tunnel protocol, causing the switch to process and forward these packets as if they were legitimately encapsulated traffic. This represents a breakdown in the decapsulation validation chain and is categorized under CWE-1023 (Inappropriate Validation). The CVSS 3.1 score of 5.8 (MEDIUM) reflects network-adjacent attack complexity with integrity impact and cross-system scope.

Business impact

Exploitation enables network-level packet manipulation that could facilitate data theft, traffic interception, or network segmentation bypass in environments relying on VXLAN or GRE tunnel isolation for multi-tenant or security-boundary separation. Datacenter operators using Arista switches for overlay network management face potential compromise of logical network boundaries, enabling an attacker to inject or redirect traffic between isolated tenants or security zones. The fact that this is being actively exploited heightens urgency for networks where tunnel-based isolation is a critical security control.

Affected systems

Arista EOS operating system running on 40+ specific switch models, including the 7020 series (SR, SRG, TR variants), 7280 series (CR, CR2, CR3, DR3, PR3, QR variants in various port and density configurations). Any deployment of these switches with tunnel decapsulation enabled—whether VXLAN overlays, GRE tunnels, or decap-groups—is in scope. Non-affected platforms or EOS deployments without tunnel decapsulation configurations are not vulnerable.

Exploitability

The vulnerability requires network access to send specially crafted packets to the affected switch's decapsulation IP endpoint (CVSS vector: AV:N, AC:L, PR:N). No authentication or user interaction is required. An attacker positioned on the network or with Layer 3 reachability to the decapsulation interface can immediately attempt exploitation. Active in-the-wild exploitation has been reported, confirming practical exploitability and indicating that proof-of-concept or attack tools may already be circulating.

Remediation

Organizations must prioritize patching Arista EOS to a version that includes protocol type validation in the tunnel decapsulation path. Verify the specific patched EOS version against the Arista advisory and test in a non-production environment before deployment. Interim mitigations may include access control lists restricting traffic destined to tunnel decapsulation endpoints to trusted sources, or temporarily disabling non-critical tunnel decapsulation configurations pending patch availability. Network segmentation limiting access to switches from untrusted network segments can also reduce immediate risk.

Patch guidance

Obtain patched EOS versions from Arista's security advisory and release notes. Verify that the version includes fixes for tunnel protocol validation in decapsulation logic. Apply patches during scheduled maintenance windows to avoid network disruption. Test patches in a lab environment with representative tunnel configurations (VXLAN, GRE, decap-groups) to confirm correct decapsulation behavior and protocol filtering post-patch. Organizations should refer to Arista's official advisory for specific version numbers and upgrade procedures.

Detection guidance

Monitor for anomalous packets arriving at tunnel decapsulation IPs with unexpected protocol types (e.g., packets claiming to be GRE-encapsulated when only VXLAN is configured, or vice versa). Capture and analyze traffic using network TAPs or switch port mirroring to identify malformed or protocol-mismatched tunnel packets. Check EOS logs and NetFlow/sFlow exports for unusual decapsulation activity, unexpected source IPs, or forwarding decisions from tunnel interfaces that deviate from policy. Correlate timing with external threat intelligence on CVE-2026-7473 exploitation campaigns to identify potential targeted activity.

Why prioritize this

This vulnerability rates HIGH priority because: (1) it is actively exploited in the wild; (2) it affects critical network infrastructure (Arista switches) in broad deployment; (3) exploitation bypasses logical network isolation mechanisms, directly undermining multi-tenancy and security segmentation; (4) no authentication is required and network access is relatively common in datacenter or enterprise environments; (5) the impact includes cross-system scope (CVSS S:C), amplifying blast radius. Organizations using Arista EOS for overlay networks should treat this as urgent.

Risk score, explained

The CVSS 3.1 score of 5.8 (MEDIUM) reflects a network-adjacent attack with low complexity and no privilege or user-interaction requirements (AV:N, AC:L, PR:N, UI:N). The C:N rating indicates no confidentiality impact, but the I:L (integrity low) rating captures the ability to modify or redirect network traffic. The S:C (changed scope) modifier elevates risk by reflecting that the vulnerability affects resources beyond the vulnerable component (cross-subnet or cross-tenant impact). While formally MEDIUM, the active exploitation status, infrastructure criticality, and network isolation bypass capability elevate actual risk to organizations significantly above the base score.

Frequently asked questions