Actively exploited
Listed in CISA’s Known Exploited Vulnerabilities catalog since June 9, 2026.
CVE-2026-7473
Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability
Arista · Extensible Operating System
Added to KEV June 9, 2026
Alert details
- Source feed
- CISA KEV
- CVE ID
- CVE-2026-7473
- CWE
- CWE-1023
- Affected products
- Extensible Operating System · Arista Extensible Operating System · Arista
What happened
Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.
What it means for your business
Arista Extensible Operating System is listed in CISA's Known Exploited Vulnerabilities catalog (CVE-2026-7473). Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. CISA remediation due date: 2026-06-23. PremierePC tracks KEV alerts for Upstate SC businesses — patch or open a ticket if you need help verifying exposure.
Required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date: June 23, 2026
Sources
Need help patching?
PremierePC monitors KEV alerts for managed clients and helps teams prioritize remediation before attackers do.