{"id":"CVE-2026-7473","published":"2026-06-05T17:17:02Z","modified":"2026-10-25T23:10:00Z","title":"Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability","vendor":"Arista","product":"Extensible Operating System","tier":"core","eol":null,"description":{"text":"On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic.\n\n\n\nThis issue has been reported as being exploited in the wild.","provenance":"source","from":"NVD"},"summary":{"text":"Arista EOS (Extensible Operating System) contains a flaw in its tunnel decapsulation handling on platforms where a decapsulation configuration such as VXLAN, decap-groups, or a GRE tunnel interface is present: the switch fails to verify the tunnel protocol type and so decapsulates and forwards unexpected tunneled packets addressed to its configured decapsulation IP. An attacker with network access to the switch can send such packets without authentication or user interaction to have non-configured tunnel traffic processed and forwarded, with a low-impact integrity effect and a scope change.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:22Z"},"cvss":{"score":5.8,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.01108,"percentile":0.65833,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2026-06-09","dueDate":"2026-06-23","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 ; https://nvd.nist.gov/vuln/detail/CVE-2026-7473","provenance":"source"},"vulncheckKev":{"dateAdded":"2026-05-05","exploitedFirstSeen":"2026-05-05","ransomware":false,"evidence":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","date":"2026-05-05"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7473","date":"2026-06-05"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-06-09"},{"url":"https://www.recordedfuture.com/blog/june-2026-cve-landscape","date":"2026-07-10"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 31, 2026","url":"https://otx.alienvault.com/pulse/6ae4aefab0c2191cecd41862","created":"2026-10-30"},{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Arista patches new VeloCloud Orchestrator zero-day exploited in attacks","url":"https://otx.alienvault.com/pulse/6ada4e1c2502752ddf07131a","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"}],"provenance":"machine"},"cwes":[{"id":"CWE-1023","name":"Incomplete Comparison with Missing Factors"}],"references":[{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137","tags":["Broken Link"]},{"url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","tags":["Mitigation","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote crafted tunneled packets exploit exposed network device","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"the switch will incorrectly decapsulate and forward other unexpected tunneled packet","start":208,"end":292}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1599","name":"Network Boundary Bridging","tactics":["defense-impairment"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Tunnel decapsulation bypasses network boundary controls","mappingType":"primary_impact","evidence":[{"from":"description","quote":"potentially leading to the unexpected processing of non-configured tunnel traffic","start":430,"end":511}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-34858","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34858","exploited":true,"exploitedSince":"2026-06-09","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-10","earliestUrl":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","repos":[{"name":"fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","url":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","stars":1,"created":"2026-06-10"}]},"first":{"date":"2026-06-10","source":"PoC-in-GitHub","url":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1599"],"provenance":"ai"}],"timeline":[{"date":"2026-05-05","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","provenance":"source"},{"date":"2026-06-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7473","provenance":"source"},{"date":"2026-06-09","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2026-06-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-34858","provenance":"source"},{"date":"2026-06-10","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/fevar54/CVE-2026-7473---Arista-EOS-Tunnel-Decapsulation-Bypass","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"PoC-in-GitHub","daysToKev":4},"priority":{"score":65.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 179 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.17,"detail":"percentile 0.6583"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.06,"detail":"base score 5.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}