CVE-2026-101158

Security Advisory 0185

State: Published
Severity: 9.3 Critical
Published: Oct 6, 2026
Updated: Oct 6, 2026
Reserved: Sep 28, 2026

Description

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H	Arista
3.1	8.4 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H	Arista

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Affected Products

Product	Versions
CloudVision PortalArista Networks	2026.2.0Affected 2026.1.0 through 2026.1.2Affected 2025.3.0 through 2025.3.3Affected 1.0.0 to before 2025.3.0Affected

References

https://www.arista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.