Arista EOS versions 4.31.0 to 4.36.0 contain a vulnerability (CVE-2026-7473) where the switch improperly decapsulates tunneled packets when a tunnel decapsulation configuration is present. Specifically, if a tunneled packet's destination IP matches the configured decapsulation IP, the switch forwards the packet without verifying the tunnel protocol type, potentially processing unexpected tunneled traffic. This incomplete comparison flaw is categorized under CWE-1023. No official fix or patch has been documented, and the vulnerability has not been reported as exploited in the wild.

The vulnerability allows the switch to process tunneled packets that were not intended to be decapsulated, which could lead to unintended forwarding of non-configured tunnel traffic. This may result in limited integrity impact due to unexpected packet processing. Confidentiality and availability impacts are not indicated. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and a scope change with integrity impact only.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — users should monitor Arista Networks advisories for updates. Until a fix is released, administrators should carefully review tunnel decapsulation configurations and consider restricting tunnel traffic to trusted sources where possible to reduce exposure.