CVE-2026-7473: Arista EOS Tunnel Decapsulation Protocol-Confusion Bypass — No Vendor Patch, Actively Exploited

CVE-2026-7473 (TL-2026-1493), also tracked as Arista EOS Tunnel Decapsulation Bypass, is a critical-severity software vulnerability scored CVSS 6.9, first published 2026-06-16. It has no confirmed attribution, affects Arista Networks EOS, references 1 CVE (CVE-2026-7473), maps to 15 MITRE ATT&CK techniques (T1036, T1040, T1041), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1493

Threat ID
TL-2026-1493
Also known as
Arista EOS Tunnel Decapsulation Bypass
Severity
CRITICAL
CVSS
6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-16
Last reviewed
2026-06-16
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
finance, government administration, telecoms, data center cloud hosting, technology, critical infrastructure
Target regions
Global, North America
Detection rules
9
Indicators of compromise
18

Malware and tooling in CVE-2026-7473

Malware and tooling: Scapy, arista_tunnel_bypass.py

Arista EOS R-series switches configured as tunnel endpoints (VXLAN, GRE, IP-in-IP, GUE) fail to validate the encapsulation protocol type of packets sent to their configured decapsulation IP, allowing an unauthenticated remote attacker to send cross-protocol tunnel traffic that the switch will unwrap and forward into the internal network, bypassing perimeter and segmentation controls. Actively exploited, added to CISA KEV, and Arista has stated no software patch will be issued.

How CVE-2026-7473 works

CVE-2026-7473 is a network-segmentation-bypass vulnerability (CWE-1023: Incomplete Comparison with Missing Factors) in Arista Extensible Operating System (EOS) affecting devices configured as tunnel decapsulation endpoints. When a switch is configured with a decapsulation IP for one tunnel protocol — for example a VXLAN VTEP, a GRE tunnel interface, or an `ip decap-group` for GUE/IP-in-IP — the switch checks only that the destination IP of an incoming encapsulated packet matches the configured decapsulation address. It does not verify that the outer packet's encapsulation protocol matches the protocol that was actually configured. As a result, a device configured only for VXLAN will also decapsulate and forward GRE and IP-in-IP traffic sent to the same address, and vice versa; GUE decap-groups accept GRE and IP-in-IP; IP-in-IPv6 decap-groups on R3-class hardware accept GREv6 and GUEv6.

An unauthenticated, network-adjacent or remote attacker exploits this by crafting a two-layer packet: an outer wrapper in ANY tunnel format supported by the platform's cross-decapsulation matrix, addressed to the switch's known decapsulation IP, wrapping an inner packet addressed to a protected internal host. The switch strips the outer wrapper without validating its protocol type and forwards the inner packet onto the internal network segment as if it were legitimately-tunneled traffic, using the switch itself as an unwitting relay that bypasses upstream firewalls, ACLs, and network segmentation that assume only the configured tunnel protocol can reach that endpoint.

The flaw is configuration-based rather than version-based: essentially all EOS releases from before 4.30.x through 4.36.x (and versions outside that range) are affected wherever tunnel decapsulation is configured on R-series hardware (7020R, 7280R/R2, 7500R/R2), with limited IP-in-IPv6/GUEv6 exposure on 7280R3, 7500R3, and 7800R3. This makes traditional version-based vulnerability scanning ineffective — detection requires auditing running configuration for decap-groups, VXLAN VTEP, and tunnel interfaces plus verifying upstream ACL coverage, which most commercial scanners cannot do.

Arista published Security Advisory 0137 on 2026-05-05 (last revised 2026-05-20) and explicitly stated no software fix is planned: changing decapsulation validation behavior risks breaking production deployments that implicitly rely on the current permissive behavior. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog on 2026-06-09 based on confirmed in-the-wild exploitation, giving FCEB agencies until 2026-06-23 to mitigate under Binding Operational Directive 22-01/26-04. A public proof-of-concept, `arista_tunnel_bypass.py`, was published to GitHub by researcher fevar54, using Python/Scapy to craft cross-protocol tunnel packets and test/exploit the decapsulation matrix; Eclypsium's write-up notes the PoC was not independently validated by them but is publicly available and lowers the bar for exploitation.

Because there is no patch path, the only mitigations are network-layer: applying ingress ACLs on upstream devices permitting only the legitimate tunnel protocol/port to the decap IP (e.g., UDP/4789 for VXLAN, IP protocol 47 for GRE), or — on the decapsulating device itself — MAC ACLs with User-Defined Fields (requiring TCAM profile changes) on 7020R/7280R/7500R, or IPv6 PACLs on 7280R3/7500R3/7800R3. Organizations must first verify the decap IP carries no BGP, SSH, or management traffic before applying deny rules, and should enable per-entry ACL counters to monitor for exploitation attempts. This is a durable, patch-nonexistent exposure in data-center spine-leaf and financial-services network fabrics that will require permanent compensating controls.

MITRE ATT&CK techniques used in TL-2026-1493

Defense Evasion

T1036 Masquerading

Discovery

T1040 Network Sniffing; T1046 Network Service Discovery

Exfiltration

T1041 Exfiltration Over C2 Channel

Initial Access

T1190 Exploit Public-Facing Application

Lateral Movement

T1210 Exploitation of Remote Services; T1570 Lateral Tool Transfer

Impact

T1498 Network Denial of Service

Command and Control

T1571 Non-Standard Port; T1572 Protocol Tunneling

command-and-control

T1572 Protocol Tunneling

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1590 Gather Victim Network Information; T1595 Active Scanning

defense-impairment

T1599 Network Boundary Bridging; T1685 Disable or Modify Tools

Affected products and versions in CVE-2026-7473

  • Arista Networks — EOS
    Vulnerable versions: 4.30.x through 4.36.x; releases older than 4.30.x; releases newer than 4.36.x
  • Arista Networks — 7020R Series switches
    Vulnerable versions: all EOS releases with tunnel decapsulation configured
  • Arista Networks — 7280R/R2 Series switches
    Vulnerable versions: all EOS releases with tunnel decapsulation configured
  • Arista Networks — 7500R/R2 Series switches
    Vulnerable versions: all EOS releases with tunnel decapsulation configured
  • Arista Networks — 7280R3 / 7500R3 / 7800R3 Series (modular routing platforms)
    Vulnerable versions: IP-in-IPv6 and GUE IPv6 decap-group configurations only

Remediation for CVE-2026-7473

Patches

  • No vendor patch is planned or available; Arista has stated in Security Advisory 0137 that changing decapsulation validation risks breaking existing production deployments

Immediate actions

  • Inventory every tunnel decapsulation endpoint via `show ip decap-group`, `show interfaces vxlan 1`, and `show interfaces Tunnel0` on all Arista R-series switches
  • Confirm decapsulation IPs carry no BGP, SSH, or management-plane traffic before applying deny ACLs
  • Apply upstream ACLs permitting only the legitimate configured tunnel protocol/port to each decapsulation IP (e.g., permit udp any host <vxlan-ip> eq 4789; deny ip any host <vxlan-ip>)
  • Enable per-entry counter logging on the new deny rules to detect exploitation attempts
  • FCEB agencies: remediate per CISA KEV / BOD directive by 2026-06-23

Workarounds

  • Ingress ACLs on upstream devices restricting traffic to the decapsulation IP to the single legitimate tunnel protocol
  • MAC ACLs with UDFs / IPv6 PACLs directly on the affected switch where upstream ACL enforcement is not feasible
  • Disable unused decap-groups and tunnel interfaces that are not operationally required

Longer-term hardening

  • On 7020R/7280R/7500R, deploy MAC ACLs with User-Defined Fields (UDFs) at the decapsulating device, which requires a TCAM profile change
  • On 7280R3/7500R3/7800R3, deploy IPv6 PACLs to restrict IP-in-IPv6/GUEv6 decapsulation to expected protocols
  • Establish continuous configuration auditing (not version-based scanning) for decap-group and tunnel-interface exposure across the fleet
  • Baseline tunnel traffic profiles via NetFlow/sFlow and alert on encapsulation-protocol deviations at decapsulation endpoints
  • Engage Arista TAC for deployment-specific mitigation design in spine-leaf/VXLAN fabrics

CVEs associated with CVE-2026-7473

CVE-2026-7473

Weaknesses (CWE) in CVE-2026-7473

CWE-1023

Timeline of CVE-2026-7473

  • Arista publishes Security Advisory 0137 disclosing CVE-2026-7473, the EOS tunnel decapsulation protocol-confusion bypass affecting R-series switches, and states exploitation has been reported.
  • Arista revises Security Advisory 0137 to revision 1.3, adding cross-protocol decapsulation matrix detail and mitigation ACL guidance for MAC ACLs/UDFs and IPv6 PACLs.
  • Researcher fevar54 publishes a public proof-of-concept exploit (arista_tunnel_bypass.py) to GitHub, using Python/Scapy to craft cross-protocol tunnel packets against the decapsulation matrix.
  • CISA adds CVE-2026-7473 to its Known Exploited Vulnerabilities (KEV) catalog alongside CVE-2026-20245 (Cisco Catalyst SD-WAN Manager) and CVE-2026-11645 (Google Chrome V8), citing confirmed in-the-wild exploitation.
  • SecurityWeek reports on the no-patch stance and active exploitation, amplifying awareness of the permanent, patch-nonexistent exposure.
  • Eclypsium publishes analysis highlighting that Arista has stated no software patch is planned and that version-based vulnerability scanners cannot detect the exposure because it is configuration-based.
  • SentinelOne and News4Hackers publish independent technical summaries and CVSS4.0 scoring (6.9) for CVE-2026-7473.
  • Threat-Modeling.com publishes MITRE ATT&CK mapping and detailed attack-scenario chain analysis for the vulnerability, emphasizing spine-leaf data-center and financial-services exposure.
  • CISA Binding Operational Directive remediation deadline for Federal Civilian Executive Branch agencies to mitigate CVE-2026-7473 per KEV catalog listing.

Sources cited for CVE-2026-7473

Threats related to CVE-2026-7473

Detection coverage for TL-2026-1493

As of 2026-06-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1493 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats