CVE-2026-101156
Security Advisory 0192
- State
- Published
- Severity
- 6.2 Medium
- Published
- Oct 6, 2026
- Updated
- Oct 6, 2026
- Reserved
- Sep 28, 2026
Description
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.2 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H | Arista |
| 3.1 | 8.4 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H | Arista |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
CloudVision CUEArista Networks |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.