CVE-2026-7473: Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability

Arista Extensible Operating System contains an incomplete comparison vulnerability that allows a switch to incorrectly decapsulate and forward certain tunneled packets whose destination IP matches a configured decapsulation address. The issue can produce unexpected packet handling on the network and requires attention from teams that operate Arista EOS devices.

How it works

The weakness is tracked as CWE-1023, incomplete comparison with missing factors. In this class of flaw the software compares only a subset of the relevant packet fields before deciding on an action. An attacker can craft a tunneled packet that supplies the expected outer destination IP while omitting or altering other factors the switch should also verify. Because the comparison is incomplete, the switch proceeds to decapsulate and forward the packet even though it does not match the intended tunnel profile.

Am I affected? How to find it in your systems

Inventory all Arista EOS switches and identify those configured for tunnel decapsulation. Review running-configuration sections that define tunnel endpoints or decapsulation IP addresses. Confirm exact software versions and configuration details against the vendor advisory, as the presence of the flaw depends on both the release and the enabled features. Monitor device logs and flow telemetry for unexpected decapsulated packets whose inner headers do not correspond to known tunnels; such traffic can indicate attempted exploitation.

How to remediate

Apply mitigations per the vendor instructions provided in the advisory. Where the advisory supplies a software update, install it on affected devices following the vendor’s upgrade process and change-control procedures. After patching, re-audit tunnel configurations to ensure only required decapsulation addresses remain active and that any unnecessary tunnel features are disabled.

If you can't patch immediately

• Segment management and data-plane traffic so that untrusted sources cannot reach the switch’s configured decapsulation IP addresses.
• Apply network-level filters that drop tunneled packets from unexpected outer source addresses before they reach EOS devices.
• Increase logging of tunnel decapsulation events and forward the records to a central collector for anomaly detection.
• Follow applicable CISA BOD 22-01 guidance for any cloud-hosted instances and discontinue use of the product if mitigations cannot be applied.

If your data may have been exposed

Actively exploited vulnerabilities of this type have led to network intrusions. Organizations can run a free exposure scan of their domains and email addresses against known breach data to determine whether related credentials or assets already appear in public records.