Stored Cross-Site Scripting Vulnerability in Arista Networks Configuration Management
CVE-2026-101156

6.2MEDIUM

Key Information:

Vendor

Arista Networks

Status
Cloudvision Cue
Vendor
CVE Published:
6 October 2026

What is CVE-2026-101156?

A stored cross-site scripting (XSS) vulnerability exists in Arista Networks' Configuration Management System, allowing an authenticated, high-privilege administrator to embed malicious scripts in configuration content. This stored content could execute in the browsers of other authenticated users when they view or compare affected configurations. By exploiting this vulnerability, attackers can manipulate the session of the victim user, potentially accessing sensitive information, altering settings, or interfering with managed wireless services.

Affected Version(s)

CloudVision CUE CloudVision CUE on-premises, virtual appliance or physical appliance 2025.2.0 <= 2026.2.0

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
6.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.