CVE-2026-7473
Arista Eos
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-7473 is a medium-severity Incomplete Comparison with Missing Factors (CWE-1023) vulnerability in Arista Eos. Its CVSS base score is 6.9 (Medium).
Operationally, ranked at the 49th percentile by exploit likelihood (below the median); CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-34858
Vulnerability Data
On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination…
more
IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
- CWE(s)
- KEV Date Added
- 09 June 2026
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandating that access-control decisions apply the full set of required rules to each request structurally eliminates missing-factor comparisons.
Access enforcement requires that every authorization decision evaluate all relevant entity attributes, directly stopping incomplete comparisons from being used.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.8.26 only requires that security requirements (including resilience against SQL injection etc.) be identified and specified during development or acquisition; it does not itself enforce, implement or assure those requirements, so the incomplete-comparison weakness can still be present and exploitable.
Secure architecture principles can require exhaustive entity comparisons, yet the control addresses many other design concerns.
Secure coding standards can forbid incomplete comparisons, but the control covers a wide range of coding issues.
Security testing can detect missing comparison factors, yet testing is only one part of the control's scope.