CVE-2026-101158

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

Score

CVSS 4.0 9.3 Critical

Status

Awaiting Analysis - psirt@arista.com

Published

2026-10-06

Last modified

2026-10-07

Weaknesses

CWE-79

Affected products

• Cloudvision Portal (Arista Networks)

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185