Input Validation Flaw in Fileserver API of Arista Networks Product
CVE-2026-101158

9.3CRITICAL

Key Information:

Vendor

Arista Networks

Status
Cloudvision Portal
Vendor
CVE Published:
6 October 2026

What is CVE-2026-101158?

An input validation flaw in the Fileserver upload API of Arista Networks' CloudVision product enables authenticated users with file upload privileges to perform stored cross-site scripting (XSS) attacks. Attackers can exploit this vulnerability to hijack the web session of another CloudVision user, potentially gaining unauthorized access to their account and administrative functions.

Affected Version(s)

CloudVision Portal CloudVision Portal on-premises, virtual appliance or physical appliance 2026.2.0

CloudVision Portal CloudVision Portal on-premises, virtual appliance or physical appliance 2026.1.0 <= 2026.1.2

CloudVision Portal CloudVision Portal on-premises, virtual appliance or physical appliance 2025.3.0 <= 2025.3.3

References

https://www.arista.com/en/support/advisories-notices/secu...
vendor-advisory

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.