CVE-2026-7473 is a tunnel protocol confusion vulnerability in Arista EOS that allows a switch to decapsulate and forward traffic without validating the inner protocol type. The CVSS 5.8 score is dangerously misleading—this is not a localized parsing bug but an infrastructure-level failure that breaks the fundamental assumption underlying all network segmentation: that traffic inside a VXLAN or GRE tunnel is isolated by protocol type and destination.
When a switch decapsulates packets without checking whether the inner protocol matches what policy expects, it effectively creates an uncontrolled pathway through security boundaries that administrators believe are intact. This is not theoretical. CISA has added this to the Known Exploited Vulnerabilities catalog, indicating active exploitation in high-value environments. The attack surface is massive: compromising a workstation is a contained breach; compromising a switch means all traffic flowing through it—including traffic the organization believes is protected by tunnel isolation—becomes potentially malleable.
The practical risk is threefold. First, an attacker can smuggle traffic past firewall policies by encapsulating it in a tunnel the firewall trusts. Second, data exfiltration becomes trivial—sensitive traffic wrapped in legitimate tunnel headers bypasses network monitoring because it appears identical to authorized encapsulated traffic. Third, covert channels can be established that evade detection by leveraging the protocol ambiguity the vulnerability creates.
What you should do now: Audit your EOS switches for any tunnel decapsulation configuration—VXLAN VNI definitions, GRE tunnel interfaces, and decap-groups are all potential vectors. Even if you believe your tunnel termination points are tightly controlled, verify that the decapsulation logic is explicitly validating inner protocol types in your security policy. Monitor for anomalous decapsulation patterns where inner protocol headers don't match the expected tunnel type. The fix in EOS addresses this validation gap, but the deployment priority should be driven by the architectural exposure, not the CVSS number—this is a segmentation-breaking flaw that warrants expedited treatment in any environment where the switch sits at a trust boundary.