Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Advisory: Arista Networks CloudVision CUE — arista.com/en/support/advisories-notices/security-advisory/… Clear all filters
TI-2026-68910 CVE-2026-102161 · GHSA-m4hm-2935-8pgp

Authentication bypass in Arista CloudVision CUE via IP spoofing

Priority LOW 39

An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative ses…

CVSS 4.0HIGH 8.7 Adjacent network No auth No interaction EPSS 0.00216 Published 2026-10-06 No fix listed CWE-290
TI-2026-68909 CVE-2026-102160 · GHSA-whcg-hw34-rm77

OS command injection in Arista CloudVision CUE backup management

Priority MEDIUM 42

An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01353 Published 2026-10-06 No fix listed CWE-78
TI-2026-68908 CVE-2026-102159 · GHSA-4pc8-pcf6-c2c3

Access control flaw in Arista CloudVision CUE backend

Priority MEDIUM 48

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00363 Published 2026-10-06 No fix listed CWE-306
TI-2026-68907 CVE-2026-102158 · GHSA-g3gj-vf89-5h45

Arista CloudVision CUE SQL Injection via API Parameters

Priority LOW 31

Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00285 Published 2026-10-06 No fix listed CWE-74
TI-2026-68906 CVE-2026-102157 · GHSA-9frv-g42f-xq53

IDOR in Arista CloudVision CUE exposes other users' transient data

Priority LOW 30

An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.

CVSS 4.0MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00249 Published 2026-10-06 No fix listed CWE-639
TI-2026-68904 CVE-2026-102155 · GHSA-2chx-rmhw-wgr5

XML external entity injection in Arista CloudVision CUE

Priority LOW 31

An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00331 Published 2026-10-06 No fix listed CWE-611