Arista EOS tunnel-traffic bypass CVE-2026-7473 exploited; no software fix planned
Attackers are exploiting CVE-2026-7473 in certain Arista network switches configured as tunnel endpoints. No patch is planned. Network administrators must apply Arista’s traffic-filtering mitigations rather than wait for an update.
If your organisation uses Arista switches, ask its network administrator to check Advisory 0137 and apply the appropriate traffic-filtering mitigations. There is no corrective EOS update to install.
What’s happening
CVE-2026-7473 affects certain Arista switches running EOS and configured to receive tunnelled network traffic. They fail to check the tunnel protocol properly, allowing unexpected traffic to be unpacked and forwarded. Arista acknowledges exploitation, and CISA listed the flaw on 9 June. The reviewed sources do not identify the attackers or establish the scale of attacks. This concerns business network equipment. As of 3 November, no software patch is planned because Arista says changing the behaviour could break existing configurations; no hotfix is available either. Administrators must instead apply access-list rules on upstream equipment or affected switches to restrict tunnel traffic. Arista’s latest advisory revision is dated 10 August.
- What
- Flaw
- Affects
- Arista EOS network switches
- Affected
- EOS: all 4.30.x–4.36.x releases, and all older and newer release trains, on affected platforms configured as tunnel endpoints.
7020R, 7280R/R2 and 7500R/R2 series.
7280R3, 7500R3 and 7800R3 series: limited to IP-in-IPv6 and GUEv6 decapsulation scenarios. - Fixed in
- No fix yet
- Since
- 9 June 2026
- Closed
- 10 Aug 2026
Timeline
- Vendor revisedNo fix yet
Arista added a machine-readable advisory. No software fix is planned and no hotfix is available.
- CISA added
CISA added CVE-2026-7473 to its Known Exploited Vulnerabilities catalogue. US federal civilian agencies were given until 23 June to address it.
- Vendor revised
Arista revised its instructions for applying access lists directly on affected switches.
- Vendor revised
Arista added a mitigation warning: filtering must preserve other legitimate traffic if the tunnel IP address also serves other purposes.
- Vendor revised
Arista clarified that exposure on 7280R3, 7500R3 and 7800R3 switches is limited.
- Made publicNo fix yet
Arista published Advisory 0137 for CVE-2026-7473, a tunnel-traffic handling flaw.
Sources
- Security Advisory 0137Arista · 5 May 2026
- No Patch Planned for Exploited Arista EOS VulnerabilitySecurityWeek · 10 June 2026
- CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active ExploitationThe Hacker News · 10 June 2026