CVE-2026-7473Active Exploitation(arista / 7020sr-24c2)

CRITICALCVSS 6.9 · MEDIUMCISA KEV

Exploitation ongoing with high activity in latest observed window (6 mentions)

Immediate actions

Patch arista 7020sr-24c2 systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.

arista CVEs Back to dashboard

8.3/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-06-23. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor / third-party advisories

https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137

Other references

Weakness type (CWE)

CWE-1023

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

7020sr-24c2
7020sr-32c2
7020srg-24c2
7020tr-48

Threat summary

Active exploitation appears in 20 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
25 mentions across 11 observed days

What's happening

Active exploitation reported across 20 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 2 signals
Patch or workaround mentioned in 5 signals
Technical details provided in 13 signals
General: 3 classified signals
Disclosure: 3 classified signals
Peaked at 6 mentions on most recent observed day (2026-07-06)
25 total mentions across 11 days

Affected systems

Vendors

arista

Products

7020sr-24c27020sr-32c27020srg-24c27020tr-487020tra-487280cr-487280cr2-607280cr2a-307280cr2a-607280cr2k-30

1 version affected across 102 products

Deep dive

Activity timeline25 mentions / 11d

Signal classification3 categories

Active Exploitation

1976.0%

General

312.0%

Disclosure

312.0%

Referenced assets15 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-05	1	Active Exploitation1
2026-06-09	2	Active Exploitation1General1
2026-06-10	4	Active Exploitation4
2026-06-11	2	Active Exploitation1General1
2026-06-13	1	Active Exploitation1
2026-06-16	3	Active Exploitation2General1
2026-06-18	3	Active Exploitation2Disclosure1
2026-06-20	1	Active Exploitation1
2026-06-24	1	Active Exploitation1
2026-06-25	1	Disclosure1
2026-07-06	6	Active Exploitation5Disclosure1

Full discourse20 posts

CISA Cyber@CISACyber133d
General
🛡️ We added Arista EOS vulnerability CVE-2026-7473, Google Chromium V8 vulnerability CVE-2026-11645, & Cisco Catalyst vulnerability CVE-2026-20245 to our KEV Catalog. Visit https://go.dhs.gov/Z3Q & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec https://t.co/wE7nxnz7xf
Post summary
The tweet announces that three CVEs have been added to the DHS KEV catalog and encourages applying mitigations, but provides no technical or exploit details.
41633525.2K
300.6K followersView on X
Paul Asadoorian @[email protected]@securityweekly126d
General
Every so often, a single CVE manages to demonstrate everything that is broken about how we discover, track, and remediate vulnerabilities, and CVE-2026-7473 in Arista EOS is one of those, which is exactly why I wrote it up. https://t.co/BXQdE6WCAj
Post summary
The tweet simply references CVE‑2026‑7473 in Arista EOS and notes the author has written about it, but gives no technical, exploit, or patch details.
140421.2K
74.7K followersView on X
piyokango@piyokango132d
Active Exploitation
米国CISAが悪用を確認した脆弱性 #KEV をカタログに追加しました。（6/9追加） 🛡 No.1616 CVE-2026-7473 Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability ===================================== ✅概要・深刻度：注意 6.8 (CVSS Base) / Arista Networks (CNA) ・種別：複数の要素を考慮しない不完全な比較 (CWE-1023) ・CVSS:CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N Arista EOS のトンネルデカプセル化処理において、トンネルプロトコル種別の検証が不十分な脆弱性です。 VXLAN、decap-groups、GRE トンネルインターフェースなどのデカプセル化設定が存在する場合、設定されたデカプセル化 IP 宛ての想定外のトンネルパケットがデカプセル化され、転送される可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：中・悪用難易度：中 ✅攻撃前提条件・影響を受ける Arista EOS ベース製品を使用している・VXLAN VTEP、GRE トンネルエンドポイント、ip decap-group などのデカプセル化 IP が構成されている・対象機器が想定外のトンネルプロトコルのパケットを受信可能である・修正済みバージョンまたは ACL 等の緩和策が適用されていない ✅悪用時影響・想定外のトンネルパケットがデカプセル化される・内部ネットワークセグメントへ意図しないトラフィックが転送される・トンネル種別による通信制御を回避される可能性がある・ネットワーク分離や経路制御の前提が崩れる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：一部公開（技術情報のみ）・ITW：確認済み（Arista Networks） Arista Networks は、脆弱性が実環境で悪用されたと報告。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-7473 ・https://www.arista.com/en/support/advisories-notices/security-advisory/24005-security-advisory-0137 🛡 No.1617 CVE-2026-11645 Google Chromium V8 Out-of-Bounds Read and Write Vulnerability ===================================== ✅概要・深刻度：重要 8.8 (CVSS Base) / CISA-ADP ・種別：境界外読み取り (CWE-125)、境界外書き込み (CWE-787) ・CVSS:CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Google Chrome の V8 に存在する境界外読み取りおよび境界外書き込みの脆弱性です。 Google Chrome 149.0.7827.103 より前のバージョンでは、リモートの攻撃者が細工した HTML ページを介して、サンドボックス内で任意コードを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：中 ✅攻撃前提条件・Google Chrome 149.0.7827.103 より前のバージョンを使用している・攻撃者が細工した HTML ページをユーザーに開かせる・V8 による当該コンテンツの処理が行われる・修正済みバージョンが適用されていない ✅悪用時影響・サンドボックス内で任意コードを実行される・メモリ破壊を引き起こされる・ブラウザ内の情報へ不正アクセスされる可能性がある・他の脆弱性と組み合わせた追加侵害につながる可能性がある ✅悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：確認済み（Google） Googleは、Exploit が存在することを認識しているとアドバイザリに記載。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-11645 ・https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html 🛡 No.1618 CVE-2026-20245 Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability ===================================== ✅概要・深刻度：重要 7.8 (CVSS Base) / Cisco Systems, Inc. (CNA) ・種別：不適切なエンコード、または出力のエスケープ (CWE-116) ・CVSS:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Cisco Catalyst SD-WAN Controller、Catalyst SD-WAN Manager、Catalyst SD-WAN Validator の CLI に存在する脆弱性です。認証済みのローカル攻撃者が細工したファイルを対象システムにアップロードすることで、root として任意コマンドを実行できる可能性があります。 ✅ChatGPTによる脆弱性評価・国内影響度：高・悪用難易度：高 ✅攻撃前提条件・影響を受ける Cisco Catalyst SD-WAN Controller、Manager、Validator を使用している・攻撃者が対象システム上で netadmin 権限を持っている・攻撃者が細工したファイルを対象システムへアップロードできる・修正済みソフトウェアが適用されていない ✅悪用時影響・root 権限で任意コマンドを実行される・対象 SD-WAN 管理基盤上で権限昇格される・edge device へ不正な設定変更を push される可能性がある・SD-WAN 環境の制御や運用に影響が生じる可能性がある悪用事例等に関する公開情報・PoC/Exploit：公開情報確認できず・ITW：確認済み（Cisco Systems, Inc.） Cisco は、限定的な事例を観測していると公表。 ✅関連情報・https://nvd.nist.gov/vuln/detail/CVE-2026-20245 ・https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sdwan-privesc-4uxFrdzx https://www.cisa.gov/news-events/alerts/2026/06/09/cisa-adds-three-known-exploited-vulnerabilities-catalog #vulnerability
Post summary
CISA has added three CVEs to its catalog, confirming they are actively exploited in the wild; the report includes technical details and vendor advisories but no publicly disclosed exploit code.
000214.3K
44.0K followersView on X
DFIR Radar@DFIR_Radar126d
Active Exploitation
CVE-2026-7473 in Arista EOS switches allows attackers to bypass network segmentation via tunnel decapsulation without protocol validation. No patch is planned, and nearly every EOS release is affected, making this a permanent configuration-driven exposure. Key details: - CVE-2026-7473 (CWE-1023): Arista EOS R-series switches (7020R, 7280R/R2, 7500R/R2) strip and forward ANY tunnel protocol (GRE, VXLAN, IP-in-IP, NVGRE, GUE) sent to a configured decap IP, regardless of which protocol was actually configured (T1599) - Attack chain: Attacker crafts a double-encapsulated packet, outer wrapper addressed to the decap IP in any supported format, inner packet targeting a protected internal segment. Switch decapsulates and delivers without firewall traversal or host compromise - Detection gap: Arista published the advisory and CVE on May 5, 2026, flagging active exploitation. CVE did not propagate to public feeds for roughly a month. CISA KEV entry did not appear until June 9, creating a 5-week blind spot for automated workflows - Scanner failure: Version-based scanners are unreliable here as nearly all EOS versions are listed as affected. The vulnerable condition is a configured decap IP reachable from untrusted networks WITHOUT restricting ACLs, not a version string - A public PoC (fevvar54) exists. Treat exploitation as live and ongoing #DFIR_Radar
Post summary
CVE-2026-7473 in Arista EOS switches permits bypassing network segmentation via tunnel decapsulation, remains permanently exposed without a patch, and is actively exploited in the wild with a publicly available PoC.
20000192
1.7K followersView on X
Lyrie.ai@lyrie_ai106d
Active Exploitation
03:00 UTC: First exploit attempt in the wild. CVE-2026-7473 added to CISA KEV: Arista Extensible Operating System
Post summary
The post reports the first observed exploitation attempt of CVE‑2026‑7473 in Arista’s Extensible Operating System, with the CVE now listed in CISA’s KEV.
1000056
309 followersView on X
Lyrie.ai@lyrie_ai106d
Active Exploitation
00:14 UTC: Thread live on @lyrie_ai. CVE-2026-7473 added to CISA KEV: Arista Extensible Operating System
Post summary
The tweet announces that CVE‑2026‑7473 has been added to the CISA KEV list for the Arista Extensible Operating System, indicating it is recognized as a vulnerability that may be exploited in the wild.
1000053
309 followersView on X
Lyrie.ai@lyrie_ai106d
Active Exploitation
00:11 UTC: GPT-5 enrichment complete. 100 words. 3 citations. CVE-2026-7473 added to CISA KEV: Arista Extensible Operating System
Post summary
The message announces that CVE-2026-7473 has been added to the CISA KEV list, indicating known or suspected exploitation, but gives no PoC, patch, or technical specifics.
1000042
309 followersView on X
Lyrie.ai@lyrie_ai106d
Disclosure
00:03 UTC: Lyrie Sentinel flagged it. CVE-2026-7473 added to CISA KEV: Arista Extensible Operating System
Post summary
The post announces CVE-2026-7473's inclusion in the CISA KEV list for the Arista Extensible Operating System, with no additional technical or exploitation details.
1000045
309 followersView on X
Lyrie.ai@lyrie_ai106d
Active Exploitation
00:00 UTC: CVE-2026-7473 disclosed. CISA: CVE-2026-7473 added to Known Exploited Vulnerabilities — Arista Extensible Operating System CVE-2026-7473 added to CISA KEV: Arista Extensible Operating System
Post summary
The announcement confirms CVE-2026-7473 is publicly disclosed and has been added to the CISA Known Exploited Vulnerabilities list, highlighting that the vulnerability is actively exploited in the wild.
1000061
309 followersView on X
UWillC@uwillc117d
Disclosure
CVE-2026-7473 in Arista EOS, CVSS 6.9, on CISA KEV with a June 23 deadline. Affects 7020R, 7280R, 7500R.
Post summary
CVE‑2026‑7473 is a medium‑severity vulnerability in Arista EOS, affecting 7020R, 7280R, and 7500R models, listed on the CISA KEV with a June 23 deadline. No PoC, exploit tool, patch, or active exploitation is detailed.
1000066
500 followersView on X
iototsecnews@iototsecnews125d
Active Exploitation
CISA KEV 警告 26/06/09：Cisco SD-WAN／Chrome V8／Arista EOS の脆弱性を追加 https://iototsecnews.jp/2026/06/10/cisa-adds-cisco-chrome-and-arista-flaws-to-kev-catalog-amid-active-exploitation/ Cisco Catalyst SD-WAN／Google Chrome V8／Arista EOS の脆弱性が、CISA KEV カタログに追加されました。Cisco の CVE-2026-20245 は、出力するデータに対する不適切なエンコード／エスケープ処理が原因です。Google の CVE-2026-11645 は、プログラムが用意したメモリの範囲を超えて読み書きを行う境界外処理が原因となっています。そして Arista の CVE-2026-7473 は、通信プロトコルの種類を正しく検証しないという不完全な比較に起因し、想定外のネットワーク通信を誤って処理してしまいます。このように、いずれの問題もデータの不適切な処理や、プログラム内での検証不足といった開発時の設計ミスが主な原因となっています。ご利用のチームは、ご注意ください。 #CISAKEV #CVE202611645 #CVE202620245 #CVE20267473 #CyberAttack #Exploit #Vulnerability
Post summary
The post announces that CISA added Cisco SD‑WAN, Chrome V8, and Arista EOS CVEs to its KEV catalog, citing ongoing active exploitation, but it does not provide PoC, exploit code, patches, or debunking details.
01000171
499 followersView on X
UWillC@uwillc126d
Active Exploitation
CVE-2026-7473, added to CISA KEV June 9, exploited in the wild. EOS decapsulates and forwards VXLAN/GRE packets matching a decap IP without checking the tunnel protocol type. Arista, advisory 0137: "No software upgrade path is planned... due to the risk of breaking existing configuration."
Post summary
CVE‑2026‑7473 has been identified by CISA as a critically exploited vulnerability, yet Arista offers no upgrade path, leaving the issue currently unpatched.
1000057
498 followersView on X
Divinmentis@Divinmentis129d
Active Exploitation
🔐 CISA KEV alert: CVE-2026-7473 affects Arista EOS tunnel decapsulation. NVD says exploited-in-the-wild cases involve devices with tunnel decap configs such as VXLAN, GRE or decap-groups. Due date: Jun 23. #Arista #KEV https://t.co/hifAJBVymc
Post summary
CISA alerts that CVE-2026-7473, affecting Arista EOS tunnel decapsulation, is being exploited in the wild on devices with VXLAN/GRE decap configurations, but no patch or workaround details are yet offered.
1000051
22 followersView on X
DecryptTheWord@Dekryptoes132d
Active Exploitation
Top 3 Cybersecurity Threats 1. CVE-2026-20245 — Cisco Catalyst SD-WAN Manager (improper output encoding; authenticated local attacker can achieve root execution via crafted file). 2. CVE-2026-7473 — Arista Extensible Operating System (incomplete tunneled-packet handling may lead to unexpected forwarding behavior). 3. CVE-2026-11645 — Google Chromium V8 (actively exploited; patch or restrict browser/Chromium-based application use). Source: CISA Known Exploited Vulnerabilities Catalog. These entries are flagged as actively exploited in the wild. #Cybersecurity #cyberwarfare
Post summary
The post identifies three CVEs that are actively exploited, provides technical details and remediation steps, and emphasizes their status as current top cyber‑threats.
0001064
126 followersView on X
キタきつね@foxbook133d
Active Exploitation
CISAが既知の悪用された脆弱性3件をカタログに追加 CISA Adds Three Known Exploited Vulnerabilities to Catalog #CISA (Jun 9) CVE-2026-7473 Arista Extensible Operating System の不完全な比較と欠落した要素の脆弱性 CVE-2026-11645 Google Chromium V8 境界外読み取り/書き込みの脆弱性 CVE-2026-20245 Cisco Catalyst SD-WAN Manager 出力の不適切なエンコードまたはエスケープの脆弱性 https://www.cisa.gov/news-events/alerts/2026/06/09/cisa-adds-three-known-exploited-vulnerabilities-catalog
Post summary
CISA announced that three CVEs—located in Arista ESOS, Chromium V8, and Cisco SD‑WAN—are known to be actively exploited, adding them to its catalog of exploited vulnerabilities.
00001233
4.8K followersView on X
Lyrie.ai@lyrie_ai106d
Active Exploitation
https://lyrie.ai/research/research/active-exploit-cve-2026-7473-extensible-operating-system #lyrie #cybersecurity #CVE #threatintel #zerodayattack
Post summary
The brief text signals that CVE‑2026‑7473 is currently being exploited—suggested by the “active exploit” descriptor and zeroday tags—but provides no concrete evidence, patch, or technical details.
0000035
309 followersView on X
TECHEPAGES@techepages118d
Active Exploitation
🚨 CISA KEV Catalog Update June 2026 (status on 24.06.2026) - actively exploited vulnerabilities in the database: 🔹 Ubiquiti UniFi OS: CVE-2026-34908/34909/34910 (due 6/26) 🔹 Lantronix EDS5000: CVE-2025-67038 (due 6/26) 🔹 Splunk Enterprise: CVE-2026-20253 (due 6/21) 🔹 Widget Factory Joomla Editor: CVE-2026-48907 (due 6/19) 🔹 Cisco SD-WAN Mgr: CVE-2026-20262 (due 6/29), CVE-2026-20245 (due 6/23) 🔹 LiteSpeed cPanel Plugin: CVE-2026-54420 (due 6/18) 🔹 Oracle PeopleSoft: CVE-2026-35273 — known ransomware use (due 6/15) 🔹 Ivanti Sentry: CVE-2026-10520 (due 6/14) 🔹 Arista EOS: CVE-2026-7473 (due 6/23) 🔹 Chromium V8: CVE-2026-11645 (due 6/23) 🔹 Check Point Gateway: CVE-2026-50751 — known ransomware use (due 6/11) 🔹 BerriAI LiteLLM: CVE-2026-42271 (due 6/22) 🔹 SolarWinds Serv-U: CVE-2026-28318 (due 6/19) 🔹 Mirasvit Cache Warmer: CVE-2026-45247 (due 6/6) 🔹 Android Framework: CVE-2025-48595 (due 6/5) 🔹 Linux Kernel: CVE-2022-0492 (due 6/5) 🔹 Oracle WebLogic: CVE-2024-21182 (due 6/4)
Post summary
The tweet lists CVEs flagged by CISA as actively exploited, without providing technical or remediation details.
00000148
17 followersView on X
DarkRelay Security Labs@darkrelaylabs122d
Active Exploitation
CISA KEV: #CVE-2026-7473 impacts Arista EOS. Actively exploited in the wild. Check devices using VXLAN/GRE tunnel decapsulation and apply mitigations. Note: CVSS 5.8 (Medium), but KEV-listed proof that exploit activity often matters more than severity. #KEV #NetworkSecurity
Post summary
CISA identifies CVE-2026-7473 as actively exploited against Arista EOS in the wild, advising mitigation for devices using VXLAN/GRE tunnel decapsulation, despite its medium CVSS score.
0000059
146 followersView on X
CiberPlaneta@CiberPlanetaOrg125d
Disclosure
🛡️ CVE-2026-7473: Vulnerabilidad crítica en Arista EOS permite reenvío de paquetes túnel no autorizados Análisis técnico del CVE-2026-7473 en Arista EOS: vulnerabilidad de comparación incompleta que permite desencapsulación y reenvío de paquetes túnel maliciosos. https://www.ciberplaneta.org/vulnerabilidades/cve-2026-7473-vulnerabilidad-critica-en-arista-eos-permite-reenvio-de-paquetes-tunel-no-autorizados/ #ciberplaneta #vulnerabilidades #cve_2026_7473 #cve #vulnerabilidad #arista #seguridad #infosec #ciberseguridad
Post summary
The post announces the discovery of CVE‑2026‑7473, explaining a comparison‑incomplete flaw that lets attackers forward malicious tunnel packets, but it does not present a PoC, exploit, or patch.
0000039
6 followersView on X
CiberPlaneta@CiberPlanetaOrg125d
Active Exploitation
🛡️ Alerta de Seguridad: Arista EOS Incomplete Comparison with Missing Factors - Reenvío Anómalo de Tráfico Tunelizado (CVE-2026-7473) Vulnerabilidad en Arista EOS permite desencapsulación y reenvío indebido de paquetes tunelizados inesperados que coincidan con la IP de decapsulación configurada. Incluida en catálogo KEV de CISA. https://www.ciberplaneta.org/boletines/118/ #ciberplaneta #bulletin #cybersecurity #cve #arista #extensible_operating_system #eos #cwe_1023 #tunnel_bypass #network_security #kev #cisa #ioc #traffic_injection #infosec #ciberseguridad
Post summary
CVE-2026-7473 is a known exploited vulnerability in Arista EOS, allowing improper tunnel packet forwarding, with no publicly disclosed PoC, exploit code, or patch mentioned.
0000039
6 followersView on X

CPE platform detail102 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

102 of 102 entries

Part	Vendor	Product	Version	Target SW	Target HW
HW	arista	7020sr-24c2	-	-	-
HW	arista	7020sr-32c2	-	-	-
HW	arista	7020srg-24c2	-	-	-
HW	arista	7020tr-48	-	-	-
HW	arista	7020tra-48	-	-	-
HW	arista	7280cr-48	-	-	-
HW	arista	7280cr2-60	-	-	-
HW	arista	7280cr2a-30	-	-	-
HW	arista	7280cr2a-60	-	-	-
HW	arista	7280cr2k-30	-	-	-
HW	arista	7280cr2k-60	-	-	-
HW	arista	7280cr2m-30	-	-	-
HW	arista	7280cr3-32d4	-	-	-
HW	arista	7280cr3-32p4	-	-	-
HW	arista	7280cr3-36s	-	-	-
HW	arista	7280cr3-96	-	-	-
HW	arista	7280cr3a-24d12	-	-	-
HW	arista	7280cr3a-48d6	-	-	-
HW	arista	7280cr3a-72	-	-	-
HW	arista	7280cr3ak-24d12	-	-	-
HW	arista	7280cr3ak-48d6	-	-	-
HW	arista	7280cr3ak-72	-	-	-
HW	arista	7280cr3am-24d12	-	-	-
HW	arista	7280cr3am-48d6	-	-	-
HW	arista	7280cr3am-72	-	-	-
HW	arista	7280cr3mk-32d4s	-	-	-
HW	arista	7280cr3mk-32p4s	-	-	-
HW	arista	7280dr3-24	-	-	-
HW	arista	7280dr3a-36	-	-	-
HW	arista	7280dr3a-54	-	-	-
HW	arista	7280dr3ak-36	-	-	-
HW	arista	7280dr3ak-54	-	-	-
HW	arista	7280dr3am-36	-	-	-
HW	arista	7280dr3am-54	-	-	-
HW	arista	7280pr3-24	-	-	-
HW	arista	7280qr-c36	-	-	-
HW	arista	7280qr-c36-m	-	-	-
HW	arista	7280qr-c72	-	-	-
HW	arista	7280qra-c36s	-	-	-
HW	arista	7280qra-c36sm	-	-	-
HW	arista	7280sr-48c6	-	-	-
HW	arista	7280sr2-48yc6	-	-	-
HW	arista	7280sr2-48yc6-m	-	-	-
HW	arista	7280sr2a-48yc6	-	-	-
HW	arista	7280sr2a-48yc6-m	-	-	-
HW	arista	7280sr2k-48c6-m	-	-	-
HW	arista	7280sr3-40yc6	-	-	-
HW	arista	7280sr3-48yc8	-	-	-
HW	arista	7280sr3m-48yc8	-	-	-
HW	arista	7280sra-48c6	-	-	-
HW	arista	7280sra-48c6-m	-	-	-
HW	arista	7280sram-48c6	-	-	-
HW	arista	7280srm-40cx2	-	-	-
HW	arista	7280tr-48c6	-	-	-
HW	arista	7280tr3-40c6	-	-	-
HW	arista	7280tra-48c6	-	-	-
HW	arista	7280tra-48c6-m	-	-	-
HW	arista	7289r3a-sc	-	-	-
HW	arista	7289r3ak-sc	-	-	-
HW	arista	7289r3am-sc	-	-	-
HW	arista	7500r-36cq-lc	-	-	-
HW	arista	7500r-36q-lc	-	-	-
HW	arista	7500r-48s2cq-lc	-	-	-
HW	arista	7500r-8cfpx-lc	-	-	-
HW	arista	7500r2-36cq-lc	-	-	-
HW	arista	7500r2a-36cq-lc	-	-	-
HW	arista	7500r2ak-36cq-lc	-	-	-
HW	arista	7500r2ak-48ycq-lc	-	-	-
HW	arista	7500r2am-36cq-lc	-	-	-
HW	arista	7500r2m-36cq-lc	-	-	-
HW	arista	7500r3-24d	-	-	-
HW	arista	7500r3-24p	-	-	-
HW	arista	7500r3-36cq	-	-	-
HW	arista	7500r3k-36cq	-	-	-
HW	arista	7500r3k-48y4d	-	-	-
HW	arista	7500rm-36cq-lc	-	-	-
HW	arista	7504r-fm	-	-	-
HW	arista	7504r3	-	-	-
HW	arista	7508r-fm	-	-	-
HW	arista	7508r3	-	-	-
HW	arista	7512r-fm	-	-	-
HW	arista	7512r3	-	-	-
HW	arista	7516-sup2	-	-	-
HW	arista	7516n-ch	-	-	-
HW	arista	7516r-fm	-	-	-
HW	arista	7800r3-36d	-	-	-
HW	arista	7800r3-48cq	-	-	-
HW	arista	7800r3a-36d	-	-	-
HW	arista	7800r3a-36dm	-	-	-
HW	arista	7800r3a-36p	-	-	-
HW	arista	7800r3a-36pm	-	-	-
HW	arista	7800r3ak-36dm	-	-	-
HW	arista	7800r3ak-36pm	-	-	-
HW	arista	7800r3k-48cq	-	-	-
HW	arista	7800r3k-48cqms	-	-	-
HW	arista	7800r3k-72y	-	-	-
HW	arista	7804r3	-	-	-
HW	arista	7808r3	-	-	-
HW	arista	7812r3	-	-	-
HW	arista	7816lr3	-	-	-
HW	arista	7816r3	-	-	-
OS	arista	eos	-	-	-

Explore more

Back to dashboard arista CVEs 7020sr-24c2 vulnerabilities

What researchers are saying

CVE-2026-7473

Paul Asadoorian @[email protected][verified]@securityweeklyGeneral

The tweet simply references CVE‑2026‑7473 in Arista EOS and notes the author has written about it, but gives no technical, exploit, or patch details.

piyokango[verified]@piyokangoActive Exploitation

CISA has added three CVEs to its catalog, confirming they are actively exploited in the wild; the report includes technical details and vendor advisories but no publicly disclosed exploit code.

DFIR Radar[verified]@DFIR_RadarActive Exploitation

CVE-2026-7473 in Arista EOS switches permits bypassing network segmentation via tunnel decapsulation, remains permanently exposed without a patch, and is actively exploited in the wild with a publicly available PoC.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

The post reports the first observed exploitation attempt of CVE‑2026‑7473 in Arista’s Extensible Operating System, with the CVE now listed in CISA’s KEV.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

The tweet announces that CVE‑2026‑7473 has been added to the CISA KEV list for the Arista Extensible Operating System, indicating it is recognized as a vulnerability that may be exploited in the wild.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

The message announces that CVE-2026-7473 has been added to the CISA KEV list, indicating known or suspected exploitation, but gives no PoC, patch, or technical specifics.

Lyrie.ai[verified]@lyrie_aiDisclosure

The post announces CVE-2026-7473's inclusion in the CISA KEV list for the Arista Extensible Operating System, with no additional technical or exploitation details.

Lyrie.ai[verified]@lyrie_aiActive Exploitation

The announcement confirms CVE-2026-7473 is publicly disclosed and has been added to the CISA Known Exploited Vulnerabilities list, highlighting that the vulnerability is actively exploited in the wild.