CVE-2026-7473
AR
Arista Extensible Operating System
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
What it is
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-013
- nvd.nist.gov/vuln/detail/CVE-2026-7473
Description and required action as published by CISA. Full record at NVD.
Other Arista entries on the list
- VeloCloud Orchestrator Arista VeloCloud Orchestrator SQL Injection Vulnerability CVE-2026-114625 · Oct 23, 2026
- VeloCloud Orchestrator Arista VeloCloud Orchestrator Improper Input Validation Vulnerability CVE-2026-93952 · Sep 22, 2026
- VeloCloud Orchestrator Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability CVE-2026-16812 · Jul 27, 2026