Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-101157: Arista CloudVision permits XSS to hijack user sessions
CVE-2026-101157 · published 5 days ago
Summary
Arista CloudVision can be tricked into storing malicious code that runs when a logged‑in user views certain pages. An attacker on the same network could use this to take over the user’s browser session, view private information or change settings. Apply the vendor’s security update or lock down network access to protect against this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| arista networks | cloudvision cue | <= 2026.2.0 |
Original advisory text
Security Advisory 0192
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen6 Oct 2026
Track software like this
Free during beta