CVE-2026-7473 is a critical vulnerability in Arista EOS caused by deficient packet validation during the decapsulation of tunnel protocol traffic. Attackers can utilize specially crafted VXLAN or GRE headers to trick the system into bypassing protocol verification, effectively decapsulating packets and forwarding them into restricted network segments. This flaw allows for a complete bypass of network segmentation and isolation controls, enabling unauthorized lateral movement across secure zones. CISA has confirmed active exploitation in the wild, necessitating immediate firmware updates to EOS versions specified in Arista Security Advisory 24005-0137 to prevent unauthorized access to protected environments.

• Vulnerability Overview: Protocol Validation Failure

  • Identification: Tracked as CVE-2026-7473 and Arista Security Advisory 24005-0137.
  • Root Cause: Failure of the EOS packet validation logic to properly verify tunnel protocol types during the decapsulation process.
  • Affected Components: Specifically impacts VXLAN implementations, GRE tunneling, and associated decap-groups.

• Technical Mechanics: Decapsulation Bypass

  • Attack Vector: Remote, network-based delivery of specially crafted tunneled packets.
  • Execution: Attackers use specific packet markers in tunnel headers to deceive the switch into decapsulating traffic meant for isolated segments.
  • Forwarding Logic: The bypass tricks the switch into forwarding traffic into restricted network zones, ignoring existing segmentation policies.

• Impact and Exploitation Status: Critical Risk

  • Exploitation Status: Confirmed active exploitation in the wild, as documented by CISA’s Known Exploited Vulnerabilities (KEV) catalog.
  • Primary Risk: Complete breakdown of network segmentation and isolation controls.
  • Potential Outcome: Unauthorized lateral movement, breach of confidentiality, and compromise of integrity within highly protected network environments.

• Mitigation and Remediation: Defensive Actions

  • Immediate Patching: Update EOS firmware to the patched versions specified in Arista Security Advisory 24005-0137.
  • Configuration Audit: Review all VXLAN and GRE tunnel interfaces and decap-groups for anomalies or unauthorized traffic flow.
  • Tracking: Monitor GHSA-mcx4-vm6v-r473 and NIST NVD for additional updates regarding this vulnerability.