Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.3
CVE-2026-101158: CloudVision portal file upload can hijack sessions
CVE-2026-101158 · published 5 days ago
Summary
The file‑upload feature in Arista’s CloudVision portal does not properly check the content that users can upload. An attacker who already has permission to upload files could place hidden code that runs in another user’s web browser, letting the attacker take over that user’s session and gain full access, including admin rights. Apply the latest CloudVision update and limit file‑upload privileges to trusted users.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| arista networks | cloudvision portal | 2026.2.0 |
Original advisory text
Security Advisory 0185
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Severity
9.3
Critical
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published6 Oct 2026
Updated7 Oct 2026
First seen6 Oct 2026
Track software like this
Free during beta