CVE-2026-7473
Incomplete Comparison with Missing Factors in Arista Extensible Operating System. CISA confirmed attackers exploit it and added it to its Known Exploited Vulnerabilities catalog on 9 June 2026.
- Product
- Arista Extensible Operating System
- Added to CISA's catalog
- Federal fix-by date
- Ransomware
- No known use in ransomware campaigns
- Vendor advisories
- Sources
- CISA’s catalog, NVD entry
CISA’s description.
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
More from Arista this year.
- CVE-2026-114625 SQL Injection, added
- CVE-2026-93952 Improper Input Validation, added
- CVE-2026-16812 On-Prem OS Command Injection, added
Every flaw CISA confirmed exploited in the last 30 days is on the exploit watch. This is not security advice. Check the vendor’s advisory before acting. From CISA’s catalog of 4 November 2026.