by Kastro
Paper/Archive/CVE-2026-101158

CVE-2026-101158

Arista Networks CloudVision Portal — Security Advisory 0185

EPSS 0.3%CVSS 9.3
critical.is priorityof 100
32
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 20.8.208 × 204.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

Affected

ProductAffectedFixed inSource
CloudVision Portal2026.2.0–CNA
CloudVision Portal2026.1.0 – 2026.1.2–CNA
CloudVision Portal2025.3.0 – 2025.3.3–CNA
CloudVision Portal1.0.0 – < 2025.3.02025.3.0CNA

Scores by source

Arista (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Arista (CNA)8.4CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryarista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185