Arista EOS CVE-2026-7473

Exploitation is only possible when the target Arista EOS switch has an active tunnel decapsulation configuration - specifically at least one of: a VXLAN VTEP/decapsulation IP, a decap-group configuration, or a GRE tunnel interface. Switches without any of these configurations are not affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms no authentication is required, no additional attack requirements apply, and no user interaction is needed once the network condition is met. The primary limiting factor is the mandatory presence of a tunnel decapsulation configuration: production datacenter switches running EVPN/VXLAN fabrics, GRE-based WAN overlays, or decap-group policies are at risk, while purely L2/L3 forwarding-only deployments without overlay configs are not. Network reachability to the decapsulation IP address is also required - switches where decap IPs are reachable only from trusted internal segments have a reduced exposure surface.

The CVSS 4.0 base score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N reflects unauthenticated, low-complexity, remotely triggerable exploitation with no user interaction needed - a favorable attack surface. However, impact is constrained: VC:N/VA:N/SC:N/SA:N, with only low integrity impact on both vulnerable and subsequent systems (VI:L/SI:L). The Exploit Maturity field (E:X) is marked 'Not Defined' in the submitted CVSS vector, which is in tension with the description's statement that the issue has been reported exploited in the wild - this discrepancy should be verified against the Arista advisory. EPSS data was not provided; the absence of a confirmed CISA KEV entry means automated, widespread scanning cannot be confirmed. Despite the moderate score, real-world risk is elevated for environments relying on VXLAN or GRE-based segmentation (multi-tenant datacenters, SD-WAN fabrics, EVPN deployments) because the vulnerability can silently bypass network boundaries. The combination of network reachability, no authentication requirement, and a reported in-the-wild status makes this a genuine operational priority for affected infrastructure despite the 'low integrity' CVSS impact rating.

An attacker on the internet or an adjacent network crafts tunneled IP packets (for example, VXLAN-encapsulated frames) addressed to a GRE-configured EOS switch's decapsulation IP. The switch, checking only the destination IP and not the protocol type, decapsulates the VXLAN frames and forwards the inner traffic into the protected network segment as if it originated from a trusted tunnel peer. This allows the attacker to inject arbitrary frames into a VLAN or tenant segment that would otherwise be inaccessible, potentially facilitating lateral movement or spoofing within that segment. No public proof-of-concept code was referenced in the provided data, but the described exploitation is low complexity given the AV:N/AC:L/PR:N CVSS profile.