Cloudvision Portal (Arista Networks) - vulnerabilities (CVEs)
12 CVEs, 8 in the last 30 days, 20 known versions, newest CVE from 2026-10-06. Vendor: Arista Networks.
CVEs of Cloudvision Portal
- CVE-2026-101155 - CVSS 9.1 (critical), 2026-10-06: An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially…
- CVE-2026-101154 - CVSS 8.6 (high), 2026-10-06: An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially…
- CVE-2026-101153 - CVSS 8 (high), 2026-10-06: On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient…
- CVE-2026-101151 - CVSS 5.3 (medium), 2026-10-06: Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the…
- CVE-2026-101152 - CVSS 8 (high), 2026-10-06: Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,…
- CVE-2026-101150 - CVSS 5.1 (medium), 2026-10-06: Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- CVE-2026-101149 - CVSS 5.1 (medium), 2026-10-06: Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
- CVE-2026-101158 - CVSS 9.3 (critical), 2026-10-06: A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored…
- CVE-2025-0505 - CVSS 10 (critical), 2025-05-08: On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges on the CloudVision…
- CVE-2024-12378 - CVSS 9.1 (critical), 2025-05-08: On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent over the secure Vxlan…
- CVE-2024-11186 - CVSS 10 (critical), 2025-05-08: On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader actions on managed EOS…
- CVE-2022-29071 - CVSS 5.5 (medium), 2022-08-05: This advisory documents an internally found vulnerability in the on premises deployment model of Arista CloudVision Portal (CVP) where under a certain set of…
