Arista EOS

Arista EOS (Extensible Operating System) is the network operating system running on Arista Networks' data-centre and campus switching hardware. In June 2026, CISA added CVE-2026-7473, a tunnel protocol verification flaw affecting the 7020R, 7280R, and 7500R series, to the Known Exploited Vulnerabilities catalogue with a 23 June federal remediation Deadline. Arista formally confirmed it has no plans to ship a software fix.

Arista EOS powers a significant share of spine and leaf switching in large-scale enterprise and cloud environments. CVE-2026-7473 stems from insufficient validation of tunnel decapsulation headers; Arista's position is that a code fix would break existing configurations, making access-control lists the only available mitigation. This is the second KEV entry in 2026 where federal agencies face a mandatory Deadline against a flaw with no vendor patch available, raising questions about the adequacy of KEV compliance mechanisms when a vendor refuses to remediate.

The case is significant for procurement and risk teams: a widely deployed network OS with an unpatched KEV-listed flaw forces a configuration-only mitigation posture indefinitely. Organisations running the affected hardware series must verify ACL coverage and document compensating controls before the federal Deadline, regardless of whether they are subject to CISA directives.