{"id":"arista-eos-tunnel-bypass-may-2026","category":"patch","status":"closed","title":"Arista EOS tunnel-traffic bypass CVE-2026-7473 exploited; no software fix planned","tldr":"Attackers are exploiting CVE-2026-7473 in certain Arista network switches configured as tunnel endpoints. No patch is planned. Network administrators must apply Arista’s traffic-filtering mitigations rather than wait for an update.","summary":"CVE-2026-7473 affects certain Arista switches running EOS and configured to receive tunnelled network traffic. They fail to check the tunnel protocol properly, allowing unexpected traffic to be unpacked and forwarded. Arista acknowledges exploitation, and CISA listed the flaw on 9 June. The reviewed sources do not identify the attackers or establish the scale of attacks. This concerns business network equipment. As of 3 November, no software patch is planned because Arista says changing the behaviour could break existing configurations; no hotfix is available either. Administrators must instead apply access-list rules on upstream equipment or affected switches to restrict tunnel traffic. Arista’s latest advisory revision is dated 10 August.","action":"If your organisation uses Arista switches, ask its network administrator to check Advisory 0137 and apply the appropriate traffic-filtering mitigations. There is no corrective EOS update to install.","product":"Arista EOS network switches","audience":"work","severity":"medium","patch":"none","exploited":true,"cves":["CVE-2026-7473"],"tags":["arista","eos","network-switch","actively-exploited","traffic-filtering"],"affected":["EOS: all 4.30.x–4.36.x releases, and all older and newer release trains, on affected platforms configured as tunnel endpoints.","7020R, 7280R/R2 and 7500R/R2 series.","7280R3, 7500R3 and 7800R3 series: limited to IP-in-IPv6 and GUEv6 decapsulation scenarios."],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Security Advisory 0137","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","date":"2026-05-05"},{"kind":"news","title":"No Patch Planned for Exploited Arista EOS Vulnerability","url":"https://www.securityweek.com/no-patch-planned-for-exploited-arista-eos-vulnerability/","by":"SecurityWeek","date":"2026-06-10"},{"kind":"news","title":"CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation","url":"https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html","by":"The Hacker News","date":"2026-06-10"}],"started":"2026-06-09","closed":"2026-08-10","created":"2026-11-03T22:19:19.431Z","updated":"2026-11-03T22:19:19.431Z","cve_notes":[{"cve":"CVE-2026-7473","name":"Arista EOS tunnel protocol validation bypass","what":"Missing protocol checks in EOS tunnel handling let attackers make affected switches accept and forward tunnel traffic they were not configured to process.","severity":"medium","cvss":5.8}],"timeline":[{"at":"2026-08-10","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Arista added a machine-readable advisory. No software fix is planned and no hotfix is available.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","patch":"none"},{"at":"2026-06-09","added":"2026-11-03T22:11:23.504Z","kind":"cisa-added","text":"CISA added CVE-2026-7473 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 23 June to address it.","url":"https://thehackernews.com/2026/06/cisa-adds-cisco-chrome-and-arista-flaws.html","by":"The Hacker News","patch":null},{"at":"2026-05-20","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Arista revised its instructions for applying access lists directly on affected switches.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","patch":null},{"at":"2026-05-13","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Arista added a mitigation warning: filtering must preserve other legitimate traffic if the tunnel IP address also serves other purposes.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","patch":null},{"at":"2026-05-07","added":"2026-11-03T22:11:23.504Z","kind":"vendor-revised","text":"Arista clarified that exposure on 7280R3, 7500R3 and 7800R3 switches is limited.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","patch":null},{"at":"2026-05-05","added":"2026-11-03T22:11:23.504Z","kind":"disclosed","text":"Arista published Advisory 0137 for CVE-2026-7473, a tunnel-traffic handling flaw.","url":"https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137","by":"Arista","patch":"none"}],"url":"https://hard.fyi/live/arista-eos-tunnel-bypass-may-2026/","json":"https://hard.fyi/api/live?id=arista-eos-tunnel-bypass-may-2026"}