3AUG

Arista refuses to patch KEV flaw

3 min read

16:08UTC

Arista Networks told customers it has no plans to fix CVE-2026-7473, an exploited tunnel-verification flaw on CISA's mandatory-remediation list, leaving federal agencies legally bound to fix something the vendor will not.

← Back to KEV deadlines fell from 14 days to three Jump to analysis ↓

TechnologyDeveloping

Key takeaway

Arista is the first vendor to formally refuse a fix for a flaw on CISA's mandatory-remediation list.

Arista Networks told customers it has no plans to ship a fix for CVE-2026-7473, a CVSS 6.9 tunnel-verification flaw in Arista EOS (Extensible Operating System) that CISA added to its KEV (Known Exploited Vulnerabilities) catalogue on 9 June with a 23 June federal deadline ¹. Affected switches configured to unwrap one tunnel type wrongly accept others instead; Arista says a code fix would break working configurations on its 7020R, 7280R and 7500R series, and offers access-control lists only. Federal agencies are now legally bound to remediate a flaw the vendor will not repair.

The KEV catalogue is CISA's list of vulnerabilities confirmed under active attack; once a flaw lands on it, US federal civilian agencies must close it by a set date. That model assumes a patch exists, or soon will. This is the second time in six weeks that the assumption has failed. The Exchange OWA flaw carried a 29 May cut-off with no fix available , and PAN-OS had a deadline land four days before its patch . Arista is the worse case of the three, because Exchange and PAN-OS merely ran late while Arista formally declines to ship anything.

BOD 22-01 (Binding Operational Directive 22-01), the November 2021 order behind the KEV catalogue, has no provision for a vendor that refuses to patch. Its remediation clock presumes the fix is the bottleneck, not the vendor's willingness to write one. The same 9 June batch added a Chrome V8 RCE (Remote Code Execution) and the seventh Cisco SD-WAN KEV entry of 2026, so the listing tempo is not slowing. For an agency running Arista in production, the only route to compliance by 23 June is network access-control lists and change-management cycles, which take longer and leave gaps a patch would not.

Deep Analysis

In plain English

Arista Networks makes the high-speed network switches used to route data traffic inside large data centres. A security flaw called CVE-2026-7473 was found in Arista's switch software that allows an attacker to send disguised network packets that the switch handles incorrectly. The US government's CISA agency added this flaw to its official must-fix list on 9 June, giving federal agencies until 23 June to address it. The unusual part: Arista told CISA that it will never release a software fix. The reason is that the flaw is tied to how the physical chips inside the switches process data, and a code change would break the switches' existing configuration. Federal agencies are instead limited to access-control lists, which are filter rules that restrict which traffic can reach the vulnerable switches but do not fix the underlying flaw.

Deep Analysis

Root Causes

Arista EOS's tunnel verification flaw reflects a design choice in the 7020R, 7280R, and 7500R hardware ASICs (application-specific integrated circuits): the chips implement tunnel-type decapsulation in hardware logic that cannot be patched via a software update without redesigning the data-plane forwarding path.

A code fix would require the OS to reject packets the ASIC has already partially processed, which breaks the forwarding pipeline and disrupts existing tunnel configurations in production deployments.

The broader structural root cause is the KEV catalogue's assumption of software-patchable infrastructure. BOD 22-01, issued in November 2021, was designed for software applications and operating systems where vendor cooperation produces a binary: patch available, or not yet available.

The directive has no compliance pathway for a vendor who formally declines to produce a patch for a hardware-constrained reason. This is the second instance in 2026 where this gap has surfaced, following PAN-OS CVE-2026-0300 where the patch deadline arrived four days before the fix shipped.

Escalation

Stable but unresolved. No evidence of mass exploitation. The risk concentrates in federal data-centre environments running the named Arista switch series. Without a vendor patch, the exposure persists indefinitely beyond the 23 June compliance deadline.

What could happen next?

Precedent
Arista's formal refusal to patch a KEV-listed flaw forces CISA to either accept an ACL-only compliance state or publish guidance for federal procurement exclusion of affected hardware series.
Short term · Assessed
Risk
Federal agencies running Arista 7020R, 7280R, or 7500R switches in segmented data-centre fabrics face a permanent residual risk without the hardware refresh required to fully remediate CVE-2026-7473.
Medium term · Assessed
Consequence
BOD 22-01 may require amendment to define a vendor non-cooperation pathway, drawing on the Arista and Exchange CVE-2026-42897 (ID:3486) cases as the documented trigger.
Medium term · Suggested

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The 2013 Cisco IOS XE CVE-2013-1135 arc demonstrates the same pattern: a tunnel-protocol verification flaw in core routing infrastructure where Cisco initially offered only ACL-based workarounds rather than a code fix, citing ASIC compatibility constraints.

Cisco eventually shipped a software fix after federal procurement pressure and a CISA predecessor-agency guidance letter gave it a documented deadline to respond to. The Arista case is further along the refusal path: a formal written statement that no fix will ship, rather than a delay in confirming one.

Counter-parallel: Microsoft's 2021 decision not to patch PrintNightmare (CVE-2021-1675) in Windows 7 ESU offers a partial counter-precedent where the vendor withheld a fix for an out-of-support platform rather than refusing on configuration-break grounds. Federal agencies in that case were directed to migrate, an option unavailable for embedded Arista 7x00R switches in production data-centre fabrics where rip-and-replace timelines run 12 to 18 months.

Consensus view: SANS Internet Storm Center analysts and Tenable Research both assess the Arista case as a structural stress-test of CISA's Binding Operational Directive 22-01 (BOD 22-01): the directive mandates remediation but assumes vendor cooperation, and Arista's formal refusal to patch exposes a gap the directive's text does not resolve.

Federal agencies running 7020R, 7280R or 7500R switches in data-centre core roles face the 23 June deadline with access-control lists as their only tool, a network-layer control that does not address the underlying tunnel verification flaw. Exchange CVE-2026-42897 was the first documented KEV entry where a federal deadline arrived without a patch; Arista's case is qualitatively worse because the vendor has formally stated no patch will ever ship.

Counter-view: Arista's own network security advisory team argues that the CVSS 6.9 score and the tunnel-decapsulation mechanism mean exploitation requires an adversary already present on an adjacent network segment, limiting the attack surface to environments with inadequate internal network segmentation.

The Chinese Academy of Information and Communications Technology's cybersecurity division has noted that Western KEV deadlines applied to enterprise switching infrastructure create compliance obligations that presuppose software-patchable architectures, a model that does not fit purpose-built networking ASICs where firmware changes risk hardware-level instability.

Key tension: Whether BOD 22-01 requires CISA to build a vendor-recourse pathway for formally refused patches, or whether the only available federal response is to prohibit procurement of affected Arista switch series in new deployments.

Sources:SecurityWeek

Mentions:AMC Networks →CVE-2026-48172 →CISA →Arista EOS →Known Exploited Vulnerabilities →Microsoft →Tenable →CVE-2026-42897 →Cisco →ASIC →nginx →Remote Code Execution →PAN-OS →BOD 22-01 →

First Reported In

Update #7 · VPN zero-day, no-patch KEV, late Exchange

SecurityWeek· 14 Jun 2026

Read original →

Causes and effects

Caused by

Exchange repeats the CISA deadline-before-patch trap

Exchange CVE-2026-42897 was the first documented KEV entry where a federal deadline landed with no patch available; Arista CVE-2026-7473 is the second instance, but more severe as the vendor formally declined to ever patch.

Occurred 15 May 2026

Read story →

CISA deadline for PAN-OS RCE lands four days early

PAN-OS CVE-2026-0300 deadline arriving four days before the patch shipped was the first documented KEV compliance gap; Arista's formal refusal to patch is a qualitatively worse failure of the same BOD 22-01 remediation model.

Occurred 6 May 2026

Read story →

Magento RCE forces 9-day patch race

Early-June KEV batch additions (Magento, WebLogic) established the velocity context for the 9 June additions including Arista EOS and Chrome V8.

Occurred 3 Jun 2026

Read story →

This Event

Arista refuses to patch KEV flaw

It is the second KEV deadline in six weeks that no patch can satisfy, exposing that CISA's compliance framework assumes a vendor fix exists.

Led to

CISA tears up its KEV deadline rules

Arista's refusal to patch a KEV-listed flaw under BOD 22-01 was a direct driver of the structural replacement with BOD 26-04's risk-tiered model.

Occurred 10 Jun 2026

Read story →

Different Perspectives

Group-IB

Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.

ENISA

ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.

House of Lords and NCSC

The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.

heise online

heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.

CISA and ReliaQuest

CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.

AIVD

AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.