Stored Cross-Site Scripting Vulnerability in Arista Products
CVE-2026-101157

9.3CRITICAL

Key Information:

Vendor

Arista Networks

Status
Cloudvision Cue
Vendor
CVE Published:
6 October 2026

What is CVE-2026-101157?

A stored cross-site scripting (XSS) vulnerability exists in Arista products, where an unauthenticated attacker with adjacent-network access can inject malicious scripts. This can occur when the affected content is viewed by an authenticated user, leading to potential session hijacking, data theft, unauthorized modifications to system states, or disruption of services due to the execution of the injected malicious content.

Affected Version(s)

CloudVision CUE CloudVision CUE on-premises, virtual appliance or physical appliance 2021.2.0 <= 2026.2.0

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.