CVE entry · CVE-2026-7473
CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
- Actively exploited: added to CISA’s KEV catalog on June 9, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: June 23, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes Arista Extensible Operating System, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.