CVE-2026-7473 is a vulnerability in Arista EOS affecting versions 4.31.0, 4.32.0, 4.33.0, 4.34.0, 4.35.0, and 4.36.0. When a tunnel decapsulation configuration such as VXLAN, decap-groups, or GRE tunnel interface is present, the switch incorrectly decapsulates and forwards tunneled packets that have a destination IP matching the configured decapsulation IP but do not match the expected tunnel protocol. This occurs due to incomplete comparison logic that omits verification of the tunnel protocol type, potentially allowing unexpected tunneled traffic to be processed. The vulnerability has been reported as exploited in the wild. The CVSS 3.1 base score is 5.8 (medium severity), with network attack vector, low attack complexity, no privileges required, no user interaction, and scope changed. No official patch or remediation level has been provided by the vendor as of the published date.

The vulnerability allows an attacker to send unexpected tunneled packets to the switch that match the configured decapsulation IP but use a different tunnel protocol than configured. This may lead to the switch incorrectly processing and forwarding these packets, potentially causing unintended network behavior or information leakage. The integrity of the network traffic can be impacted, but confidentiality and availability impacts are not indicated. The scope of the vulnerability is changed, meaning it can affect resources beyond the initially vulnerable component.

No official patch or remediation has been announced by Arista Networks as of the publication date. Users should monitor the vendor advisory for updates and consider restricting tunnel decapsulation configurations or applying network-level controls to limit unexpected tunneled traffic until a fix is available. Since the vendor has not provided a remediation level or patch, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.