CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison Vulnerability Allows Unauthorized Packet Decapsulation
What It Is — Arista EOS contains an incomplete comparison with missing factors flaw. When a switch decapsulates tunneled traffic, it may forward packets whose destination IP matches the configured decapsulation IP even if other packet attributes differ, effectively bypassing intended traffic filters.
Exploitability — No public exploit or proof‑of‑concept has been released, but the vulnerability is rated CVSS 7.8 (High) by NVD, indicating that a network‑adjacent adversary could leverage it to inject or intercept traffic.
Affected Products — All Arista switches running the Extensible Operating System (EOS) versions prior to the vendor‑issued patch (see CISA KEV entry).
Why It Matters for Trust & Control Assurance
- Configuration integrity – The flaw highlights the risk of incomplete device‑level validation; continuous configuration monitoring is essential to prove that network controls remain effective.
- Audit evidence – Demonstrating that decapsulation rules are correctly enforced provides defensible evidence for auditors assessing change‑control and traffic‑filtering controls.
- Enterprise buyer expectations – Buyers increasingly demand proof that network devices are continuously verified against a trusted baseline before they can be trusted in multi‑cloud or hybrid environments.
Recommended Actions
- Apply Arista’s security patch for CVE‑2026‑7473 immediately.
- Audit existing EOS decapsulation configurations for any rules that could be abused under the described condition.
- Enable detailed logging of decapsulation events and integrate logs into a SIEM for real‑time anomaly detection.
- Map the finding to the control objective “Secure configuration management and change control of network devices” and capture remediation evidence in your Trust Center.
Source: CISA KEV – CVE‑2026‑7473