Arista EOS Tunnel Decapsulation Protocol Validation Vulnerability (CVE-2026-7473) Advisory

Affected Vendors

arista

Affected Components

eos

Published Date

2026-06-05

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Arista EOS-based switches configured with tunnel decapsulation such as VXLAN, decap-groups, or GRE tunnel interfaces

Impact

Attackers can bypass security boundaries by sending unexpected tunneled packets, which the switch incorrectly decapsulates and forwards. This vulnerability is actively exploited in the wild

Mitigation

Apply the latest EOS security patches from Arista or implement inbound Access Control Lists (ACLs) to restrict unauthorized tunnel traffic

Affected Products & Version Scope

Arista EOS platforms running with active tunnel decapsulation configurations (VXLAN, decap-groups, or GRE tunnel interfaces)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Apply Official Patches

Refer to the Arista Security Advisory and upgrade to the remediated EOS software version.

2. Temporary Mitigation

If immediate patching is not feasible, implement inbound Access Control Lists (ACLs) on edge interfaces to drop unauthorized tunneling traffic.

[Example ACL Configuration] Block unauthorized VXLAN (UDP 4789) and GRE (Protocol 47) traffic from untrusted sources:

text

ip access-list ACL_BLOCK_UNAUTHORIZED_TUNNELS
   deny udp any any eq 4789
   deny gre any any
   permit ip any any
!
interface ethernet 1/1
   ip access-group ACL_BLOCK_UNAUTHORIZED_TUNNELS in

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

As this vulnerability is actively exploited in the wild (CISA KEV), immediately audit your Arista EOS configurations and apply the vendor patches.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

This vulnerability (CVE-2026-7473) is a protocol validation flaw (CWE-1023) in Arista EOS during the processing of tunnel decapsulation.

When a switch is configured with tunnel decapsulation features (such as VXLAN, decap-groups, or GRE), it checks if the destination IP of an incoming packet matches its configured decapsulation IP. However, the switch fails to properly verify the tunnel protocol type.

Consequently, the switch incorrectly decapsulates and forwards unexpected tunneled packets even if the specific tunnel protocol is not configured on the device. This allows attackers to inject arbitrary packets into the internal network, bypassing perimeter controls. Due to active exploitation in the wild, this vulnerability has been added to the CISA KEV catalog.

Official Vendor Advisories & References

NVD Original English Description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137

Source: psirt@arista.com · Broken Link

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Mitigation, Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-7473

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: