Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
306 vulnerabilities by Arista Networks
CVE-2026-102169 (GCVE-0-2026-102169)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0194
Summary
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:06 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:06:55.662490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:05.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:30.888Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102169 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102169 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0194",
"defects": [
"BUG 1846913"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0194",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available.\u003c/p\u003e"
}
],
"value": "If Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102169",
"datePublished": "2026-10-06T19:40:30.888Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:07:05.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102168 (GCVE-0-2026-102168)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:06
VLAI
EPSS
VEX
Title
Security Advisory 0194
Summary
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:06 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:06:24.609870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:06:39.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:30.345Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102168 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102168 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0194",
"defects": [
"BUG 1774072"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0194",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available.\u003c/p\u003e"
}
],
"value": "If Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102168",
"datePublished": "2026-10-06T19:40:30.345Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:06:39.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102167 (GCVE-0-2026-102167)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0197
Summary
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:00:24.458435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:36.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network.\u003c/p\u003e"
}
],
"value": "No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.432Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102167 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102167 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0197",
"defects": [
"BUG 1846909"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0197",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102167",
"datePublished": "2026-10-06T19:40:32.432Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:00:36.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102165 (GCVE-0-2026-102165)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0198
Summary
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:59 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:59:55.213686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:05.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.909Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102165 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102165 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0198",
"defects": [
"BUG 1846910"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0198",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".\u003c/p\u003e"
}
],
"value": "When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\"."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102165",
"datePublished": "2026-10-06T19:40:32.909Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:00:05.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102164 (GCVE-0-2026-102164)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0196
Summary
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:07:46.593021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:54.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client.\u003c/p\u003e"
}
],
"value": "VXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.\u003c/p\u003e"
}
],
"value": "On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:31.913Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102164 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102164 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0196",
"defects": [
"BUG 1774082"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0196",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure.\u003c/p\u003e"
}
],
"value": "If VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102164",
"datePublished": "2026-10-06T19:40:31.913Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:07:54.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102163 (GCVE-0-2026-102163)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0195
Summary
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:07 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:07:23.178346Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:33.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe wireless sensor service processes beacon and probe response frames as part of normal operation. Any access point with WIPS or wireless monitoring enabled is potentially exposed because any client in RF vicinity can trigger it.\u003c/p\u003e"
}
],
"value": "The wireless sensor service processes beacon and probe response frames as part of normal operation. Any access point with WIPS or wireless monitoring enabled is potentially exposed because any client in RF vicinity can trigger it."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.\u003c/p\u003e"
}
],
"value": "On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:31.435Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24811-security-advisory-0195"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102163 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102163 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0195",
"defects": [
"BUG 1774048"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0195",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102163",
"datePublished": "2026-10-06T19:40:31.435Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:07:33.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102162 (GCVE-0-2026-102162)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:06
VLAI
EPSS
VEX
Title
Security Advisory 0193
Summary
On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:05 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102162",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:05:56.170458Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:06:08.243Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCaptive portal, or application firewall must be enabled on at least one SSID. If none of these features are configured, the web gateway service does not perform the lookups that expose this vulnerability. Additionally, this can be exploited by an associated client.\u003c/p\u003e"
}
],
"value": "Captive portal, or application firewall must be enabled on at least one SSID. If none of these features are configured, the web gateway service does not perform the lookups that expose this vulnerability. Additionally, this can be exploited by an associated client."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points with captive portal, or application firewall enabled on at least one SSID, a vulnerability in the wireless gateway service could allow an unauthenticated network-adjacent attacker to send a crafted packet that triggers a stack overflow, resulting in a denial-of-service condition or potentially execute arbitrary code on the device. The wireless gateway service is automatically restarted after a crash, allowing repeated exploitation attempts."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:29.864Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24809-security-advisory-0193"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102162 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102162 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0193",
"defects": [
"BUG 1774040"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0193",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf captive portal and application firewall are not required, disabling these features on all SSIDs eliminates exposure to this vulnerability.\u003c/p\u003e"
}
],
"value": "If captive portal and application firewall are not required, disabling these features on all SSIDs eliminates exposure to this vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102162",
"datePublished": "2026-10-06T19:40:29.864Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:06:08.243Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102161 (GCVE-0-2026-102161)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:04
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:04 UTC
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102161",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:04:00.722473Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:04:10.245Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend.\u003c/p\u003e"
}
],
"value": "An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gain administrative session privileges on the CV-CUE backend."
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication Bypass by Spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:54.646Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102161 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102161 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1728203"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102161",
"datePublished": "2026-10-06T19:39:54.646Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:04:10.245Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102160 (GCVE-0-2026-102160)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:03
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:03 UTC
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102160",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:03:34.193659Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:03:43.702Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service.\u003c/p\u003e"
}
],
"value": "An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:54.096Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102160 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102160 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1728182"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102160",
"datePublished": "2026-10-06T19:39:54.096Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:03:43.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102159 (GCVE-0-2026-102159)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:03
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:03 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2022.3.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102159",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:03:00.815750Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:03:15.078Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2022.3.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.\u003c/p\u003e"
}
],
"value": "An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115 Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:53.582Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102159 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102159 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1732043"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102159",
"datePublished": "2026-10-06T19:39:53.582Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:03:15.078Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102158 (GCVE-0-2026-102158)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:02
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:02 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2022.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:02:19.932346Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:02:40.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2022.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.\u003c/p\u003e"
}
],
"value": "Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability."
}
],
"impacts": [
{
"capecId": "CAPEC-66",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-66 SQL Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:53.096Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102158 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102158 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1731886"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102158",
"datePublished": "2026-10-06T19:39:53.096Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:02:40.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102157 (GCVE-0-2026-102157)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:02
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user's transient data.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:01 UTC
CWE
- CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:01:56.142507Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:02:04.283Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user\u0027s transient data.\u003c/p\u003e"
}
],
"value": "An insecure direct object reference (IDOR) vulnerability in a CloudVision CUE file-serving interface may allow an authenticated network user, under specific attack conditions, to access another user\u0027s transient data."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:52.569Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102157 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102157 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1728161"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102157",
"datePublished": "2026-10-06T19:39:52.569Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:02:04.283Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102156 (GCVE-0-2026-102156)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:04
VLAI
EPSS
VEX
Title
Security Advisory 0191
Summary
Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:04 UTC
CWE
- CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:04:24.354512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:04:33.983Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eBoth of the following conditions must be met:\u003c/p\u003e\u003col\u003e\u003cli\u003eCV-CUE backend (wifimanager) must be enabled and running.\u003c/li\u003e\u003cli\u003eLDAP authentication must be enabled for the User Accounts.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003eTo inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "Both of the following conditions must be met:\n1. CV-CUE backend (wifimanager) must be enabled and running.\n2. LDAP authentication must be enabled for the User Accounts.\n\nTo inspect the status of wifimanager:\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eImproper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service.\u003c/p\u003e"
}
],
"value": "Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service."
}
],
"impacts": [
{
"capecId": "CAPEC-136",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-136 LDAP Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:28.369Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24807-security-advisory-0191"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102156 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102156 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0191",
"defects": [
"BUG 1731907"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0191",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe recommended mitigation is to disable LDAP Authentication. Prior to implementing this, please ensure that an alternative authentication mechanism is properly configured and verified, as disabling LDAP authentication will prevent LDAP-dependent users from accessing or managing CV-CUE.\u003c/p\u003e"
}
],
"value": "The recommended mitigation is to disable LDAP Authentication. Prior to implementing this, please ensure that an alternative authentication mechanism is properly configured and verified, as disabling LDAP authentication will prevent LDAP-dependent users from accessing or managing CV-CUE."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102156",
"datePublished": "2026-10-06T19:40:28.369Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:04:33.983Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102155 (GCVE-0-2026-102155)
Vulnerability from nvd – Published: 2026-10-06 19:39 – Updated: 2026-10-06 20:01
VLAI
EPSS
VEX
Title
Security Advisory 0190
Summary
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:01 UTC
CWE
- CWE-611 - Improper Restriction of XML External Entity Reference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:01:34.634435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:01:43.823Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE backend (wifimanager) must be enabled and running. To inspect the status of wifimanager:\n\n[root@]# cvpi status wifimanager\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service.\u003c/p\u003e"
}
],
"value": "An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure and partial denial of service."
}
],
"impacts": [
{
"capecId": "CAPEC-221",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-221 Data Serialization External Entities Blowup"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:L/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper Restriction of XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:39:52.037Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102155 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102155 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0190",
"defects": [
"BUG 1728574",
"BUG 1728163"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0190",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102155",
"datePublished": "2026-10-06T19:39:52.037Z",
"dateReserved": "2026-09-28T17:41:09.358Z",
"dateUpdated": "2026-10-06T20:01:43.823Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101158 (GCVE-0-2026-101158)
Vulnerability from nvd – Published: 2026-10-06 19:36 – Updated: 2026-10-06 19:51
VLAI
EPSS
VEX
Title
Security Advisory 0185
Summary
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.
Severity
8.4 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:51 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 1.0.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101158",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:51:37.462404Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:46.864Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal on-premises, virtual appliance or physical appliance",
"CV-CUE on-premises"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e"
}
],
"value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user\u0027s web session, potentially granting full access to their account and administrative permissions.\u003c/p\u003e"
}
],
"value": "A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user\u0027s web session, potentially granting full access to their account and administrative permissions."
}
],
"impacts": [
{
"capecId": "CAPEC-86",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-86 XSS Using HTTP Query Strings"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:36:51.571Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101158 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101158 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0185",
"defects": [
"BUG 1867488"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0185",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation available for this vulnerability. However, operators should ensure that roles with file upload permissions are restricted to trusted users. Review any role that has \"Read and Write\" permission on: Bug Alert Management, File, Packaging, Image Repository. Navigate to \u003cstrong\u003eSettings \u2192 Roles\u003c/strong\u003e to review role permissions, and \u003cstrong\u003eSettings \u2192 Users\u003c/strong\u003e to ensure only trusted users are assigned to those roles.\u003c/p\u003e"
}
],
"value": "There is no mitigation available for this vulnerability. However, operators should ensure that roles with file upload permissions are restricted to trusted users. Review any role that has \"Read and Write\" permission on: Bug Alert Management, File, Packaging, Image Repository. Navigate to Settings \u2192 Roles to review role permissions, and Settings \u2192 Users to ensure only trusted users are assigned to those roles."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101158",
"datePublished": "2026-10-06T19:36:51.571Z",
"dateReserved": "2026-09-28T08:30:31.035Z",
"dateUpdated": "2026-10-06T19:51:46.864Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101157 (GCVE-0-2026-101157)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:05
VLAI
EPSS
VEX
Title
Security Advisory 0192
Summary
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt affected services.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:05 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2021.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101157",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:05:27.586474Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:05:36.991Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2021.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE UI must be enabled and running. The status can be audited with the command \u003ccode\u003ecvpi status aware\u003c/code\u003e:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status aware\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\nsecondary components total:1 running:1 disabled:0\ntertiary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE UI must be enabled and running. The status can be audited with the command \"cvpi status aware\":\n\n[root@]# cvpi status aware\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\nsecondary components total:1 running:1 disabled:0\ntertiary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim\u0027s authenticated browser session, access sensitive data, modify system state, or disrupt affected services.\u003c/p\u003e"
}
],
"value": "A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected content. Successful exploitation may allow the attacker to compromise the victim\u0027s authenticated browser session, access sensitive data, modify system state, or disrupt affected services."
}
],
"impacts": [
{
"capecId": "CAPEC-86",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-86 XSS Using HTTP Query Strings"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:29.387Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101157 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101157 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0192",
"defects": [
"BUG 1802841"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0192",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101157",
"datePublished": "2026-10-06T19:40:29.387Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T20:05:36.991Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101156 (GCVE-0-2026-101156)
Vulnerability from nvd – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:05
VLAI
EPSS
VEX
Title
Security Advisory 0192
Summary
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:04 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision CUE |
Affected:
2025.2.0 , ≤ 2026.2.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101156",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:04:54.409170Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:05:03.281Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision CUE on-premises, virtual appliance or physical appliance"
],
"product": "CloudVision CUE",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "2026.2.0",
"status": "affected",
"version": "2025.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTo be vulnerable, CV-CUE UI must be enabled and running. The status can be audited with the command \u003ccode\u003ecvpi status aware\u003c/code\u003e:\u003c/p\u003e\u003cpre\u003e[root@]# cvpi status aware\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\nsecondary components total:1 running:1 disabled:0\ntertiary components total:1 running:1 disabled:0\u003c/pre\u003e"
}
],
"value": "To be vulnerable, CV-CUE UI must be enabled and running. The status can be audited with the command \"cvpi status aware\":\n\n[root@]# cvpi status aware\nExecuting command. This may take some time...\nCompleted 1/1 discovered actions\nprimary components total:1 running:1 disabled:0\nsecondary components total:1 running:1 disabled:0\ntertiary components total:1 running:1 disabled:0"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user\u0027s browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim\u0027s authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.\u003c/p\u003e"
}
],
"value": "A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user\u0027s browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim\u0027s authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services."
}
],
"impacts": [
{
"capecId": "CAPEC-86",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-86 XSS Using HTTP Query Strings"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:28.902Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101156 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101156 has been fixed in the following releases:\n- 2026.2.1 and later releases"
}
],
"source": {
"advisory": "Security Advisory 0192",
"defects": [
"BUG 1782052"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0192",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available for this issue.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101156",
"datePublished": "2026-10-06T19:40:28.902Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T20:05:03.281Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101155 (GCVE-0-2026-101155)
Vulnerability from nvd – Published: 2026-10-06 19:38 – Updated: 2026-10-06 20:01
VLAI
EPSS
VEX
Title
Security Advisory 0189
Summary
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:01 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2024.2.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101155",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:01:03.294569Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:01:14.740Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2024.2.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e"
}
],
"value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.\u003c/p\u003e"
}
],
"value": "An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:38:23.503Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101155 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101155 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0189",
"defects": [
"BUG 1898846"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0189",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation available for this vulnerability.\u003c/p\u003e"
}
],
"value": "There is no mitigation available for this vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101155",
"datePublished": "2026-10-06T19:38:23.503Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T20:01:14.740Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101154 (GCVE-0-2026-101154)
Vulnerability from nvd – Published: 2026-10-06 19:38 – Updated: 2026-10-07 16:29
VLAI
EPSS
VEX
Title
Security Advisory 0189
Summary
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-07 16:29 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2018.1.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101154",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-07T16:29:22.498147Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-07T16:29:37.385Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2018.1.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e"
}
],
"value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAn authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.\u003c/p\u003e"
}
],
"value": "An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:38:22.940Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24805-security-advisory-0189"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101154 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101154 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0189",
"defects": [
"BUG 1898843"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0189",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation available for this vulnerability.\u003c/p\u003e"
}
],
"value": "There is no mitigation available for this vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101154",
"datePublished": "2026-10-06T19:38:22.940Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-07T16:29:37.385Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101153 (GCVE-0-2026-101153)
Vulnerability from nvd – Published: 2026-10-06 19:38 – Updated: 2026-10-06 19:49
VLAI
EPSS
VEX
Title
Security Advisory 0188
Summary
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:49 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2025.2.0 , ≤ 2025.2.3 (custom) Affected: 2025.1.0 , ≤ 2025.1.4 (custom) Affected: 2024.3.0 , ≤ 2024.3.3 (custom) |
|
| Arista Networks | CloudVision Sensor |
Affected:
1.4.0 , ≤ 1.4.2
(custom)
Affected: 1.3.0 , ≤ 1.3.1 (custom) Affected: 1.0.0 , < 1.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101153",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:49:23.342532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:31.675Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.2.3",
"status": "affected",
"version": "2025.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.1.4",
"status": "affected",
"version": "2025.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2024.3.3",
"status": "affected",
"version": "2024.3.0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Sensor"
],
"product": "CloudVision Sensor",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "1.4.2",
"status": "affected",
"version": "1.4.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "1.3.0",
"versionType": "custom"
},
{
"lessThan": "1.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e"
}
],
"value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.\u003c/p\u003e"
}
],
"value": "On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:38:07.896Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24804-security-advisory-0188"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101153 has been fixed in the following releases:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Portal:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Sensor:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e1.4.3 and later releases in the 1.4.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101153 has been fixed in the following releases:\n\nCloudVision Portal:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n\nCloudVision Sensor:\n- 1.4.3 and later releases in the 1.4.x train"
}
],
"source": {
"advisory": "Security Advisory 0188",
"defects": [
"BUG 1898011"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0188",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\u003c/p\u003e\u003cpre\u003e# Stop sensor completely:\ncvpi stop sensor\u003c/pre\u003e\u003cp\u003eTo undo this and to start the sensor again use:\u003c/p\u003e\u003cpre\u003e# Start sensor:\ncvpi start sensor\u003c/pre\u003e"
}
],
"value": "There is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\n\n# Stop sensor completely:\ncvpi stop sensor\n\nTo undo this and to start the sensor again use:\n\n# Start sensor:\ncvpi start sensor"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101153",
"datePublished": "2026-10-06T19:38:07.896Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T19:49:31.675Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101152 (GCVE-0-2026-101152)
Vulnerability from nvd – Published: 2026-10-06 19:37 – Updated: 2026-10-06 19:49
VLAI
EPSS
VEX
Title
Security Advisory 0187
Summary
Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:49 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2021.1.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101152",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:49:47.242959Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:49:57.474Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2021.1.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-101152, SSO must be configured with an external identity provider. Deployments using only non-SSO authentication are not affected. To check if SSO is configured, navigate to \u003cstrong\u003eSettings \u2192 Authentication\u003c/strong\u003e in the CloudVision UI. If an OIDC or SAML provider is configured, the deployment is potentially affected.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-101152, SSO must be configured with an external identity provider. Deployments using only non-SSO authentication are not affected. To check if SSO is configured, navigate to Settings \u2192 Authentication in the CloudVision UI. If an OIDC or SAML provider is configured, the deployment is potentially affected."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.\u003c/p\u003e"
}
],
"value": "Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision."
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:37:53.573Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101152 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101152 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0187",
"defects": [
"BUG 1864515"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0187",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation exists for this issue.\u003c/p\u003e"
}
],
"value": "No mitigation exists for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101152",
"datePublished": "2026-10-06T19:37:53.573Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T19:49:57.474Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101151 (GCVE-0-2026-101151)
Vulnerability from nvd – Published: 2026-10-06 19:37 – Updated: 2026-10-06 19:50
VLAI
EPSS
VEX
Title
Security Advisory 0187
Summary
Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user's browser to an arbitrary external site upon completion of the authentication process.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:50 UTC
CWE
- CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2020.3.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:50:14.324307Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:22.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2020.3.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected CloudVision releases.\u003c/p\u003e"
}
],
"value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected CloudVision releases."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user\u0027s browser to an arbitrary external site upon completion of the authentication process.\u003c/p\u003e"
}
],
"value": "Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, redirects the user\u0027s browser to an arbitrary external site upon completion of the authentication process."
}
],
"impacts": [
{
"capecId": "CAPEC-194",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-194 Fake the Source of Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:37:53.059Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24803-security-advisory-0187"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101151 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101151 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0187",
"defects": [
"BUG 1612748"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0187",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo mitigation exists for this issue.\u003c/p\u003e"
}
],
"value": "No mitigation exists for this issue."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101151",
"datePublished": "2026-10-06T19:37:53.059Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T19:50:22.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101150 (GCVE-0-2026-101150)
Vulnerability from nvd – Published: 2026-10-06 19:37 – Updated: 2026-10-06 19:50
VLAI
EPSS
VEX
Title
Security Advisory 0186
Summary
Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
Severity
4.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:50 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2023.3.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101150",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:50:37.698532Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:50:49.110Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2023.3.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and \u003cstrong\u003eAllow Bearer Token Login\u003c/strong\u003e must be enabled in cluster management settings. To verify, navigate to \u003cstrong\u003eGeneral Settings \u2192 Cluster Management\u003c/strong\u003e. If the \u003cem\u003eAllow Bearer Token Login\u003c/em\u003e toggle is disabled, there is no exposure to this issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-101150, OAuth SSO must be configured and Allow Bearer Token Login must be enabled in cluster management settings. To verify, navigate to General Settings \u2192 Cluster Management. If the \"Allow Bearer Token Login\" toggle is disabled, there is no exposure to this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.\u003c/p\u003e"
}
],
"value": "Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server-Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:37:25.747Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101150 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101150 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0186",
"defects": [
"BUG 1919438"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0186",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.\u003c/p\u003e"
}
],
"value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101150",
"datePublished": "2026-10-06T19:37:25.747Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T19:50:49.110Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-101149 (GCVE-0-2026-101149)
Vulnerability from nvd – Published: 2026-10-06 19:37 – Updated: 2026-10-06 19:51
VLAI
EPSS
VEX
Title
Security Advisory 0186
Summary
Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.
Severity
4.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:51 UTC
CWE
- CWE-918 - Server-Side Request Forgery (SSRF)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | CloudVision Portal |
Affected:
2026.2.0
(custom)
Affected: 2026.1.0 , ≤ 2026.1.2 (custom) Affected: 2025.3.0 , ≤ 2025.3.3 (custom) Affected: 2020.3.0 , < 2025.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-101149",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:51:08.204808Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:51:18.383Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"CloudVision Portal, virtual appliance or physical appliance"
],
"product": "CloudVision Portal",
"vendor": "Arista Networks",
"versions": [
{
"status": "affected",
"version": "2026.2.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2026.1.2",
"status": "affected",
"version": "2026.1.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "2025.3.3",
"status": "affected",
"version": "2025.3.0",
"versionType": "custom"
},
{
"lessThan": "2025.3.0",
"status": "affected",
"version": "2020.3.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to \u003cstrong\u003eSettings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers\u003c/strong\u003e. If any provider appears under the \u003cstrong\u003eOAuth Providers\u003c/strong\u003e section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable to CVE-2026-101149, OAuth SSO must be configured. To verify, navigate to Settings \u2192 Access Management \u2192 Authentication \u2192 SSO Providers. If any provider appears under the OAuth Providers section, OAuth SSO is configured. If no provider is listed, there is no exposure to this issue."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations.\u003c/p\u003e"
}
],
"value": "Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary destinations."
}
],
"impacts": [
{
"capecId": "CAPEC-664",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-664 Server-Side Request Forgery"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side Request Forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:37:25.250Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24802-security-advisory-0186"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-101149 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003cli\u003e2025.3.4 and later releases in the 2025.3.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-101149 has been fixed in the following releases:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n- 2025.3.4 and later releases in the 2025.3.x train"
}
],
"source": {
"advisory": "Security Advisory 0186",
"defects": [
"BUG 1919444"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0186",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only.\u003c/p\u003e"
}
],
"value": "There is no configuration-based mitigation for this issue. However, operators can consider switching to an alternative non-OIDC SSO login method, if feasible. Additionally, restrict AAA settings and Account Management configuration permissions to trusted personnel only."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-101149",
"datePublished": "2026-10-06T19:37:25.250Z",
"dateReserved": "2026-09-28T08:30:31.034Z",
"dateUpdated": "2026-10-06T19:51:18.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102165 (GCVE-0-2026-102165)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0198
Summary
On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 19:59 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102165",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T19:59:55.213686Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:05.234Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eA Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "A Live Packet Capture session using \"Wireshark on local machine\" as the streaming option, which is a non-default operation, must be actively running from the management UI to expose this vulnerability. The capture service only listens while a capture session is active. Once initiated, the access point remains vulnerable to any attacker with network access to the capture service for the duration of the capture session. If no Live Packet Capture session with \"Wireshark on local machine\" as the streaming option is in progress, the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, an unauthenticated attacker with network access to the capture service can send a crafted packet to cause the service to crash or potentially achieve remote code execution. This exploit requires an uncommonly used non-default streaming mode."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.909Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24814-security-advisory-0198"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102165 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102165 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0198",
"defects": [
"BUG 1846910"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0198",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eWhen using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\".\u003c/p\u003e"
}
],
"value": "When using Live Packet Capture, use \"Upload to server\" as the streaming option instead of \"Wireshark on local machine\"."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102165",
"datePublished": "2026-10-06T19:40:32.909Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:00:05.234Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102167 (GCVE-0-2026-102167)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:00
VLAI
EPSS
VEX
Title
Security Advisory 0197
Summary
On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point's wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point's wired uplink.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:00 UTC
CWE
- CWE-121 - Stack-based Buffer Overflow
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102167",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:00:24.458435Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:00:36.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eNo specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network.\u003c/p\u003e"
}
],
"value": "No specific configuration is required beyond default operation. However, exploitation requires the attacker to have access to the access point\u0027s wired uplink network."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points, a memory corruption vulnerability exists in access point\u0027s wired uplink network endpoints. An unauthenticated attacker can crash the sensor service or potentially achieve remote code execution. Exploitation requires the attacker to be on the same network segment as the access point\u0027s wired uplink."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack-based Buffer Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:32.432Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24813-security-advisory-0197"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102167 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102167 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0197",
"defects": [
"BUG 1846909"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0197",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102167",
"datePublished": "2026-10-06T19:40:32.432Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:00:36.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102164 (GCVE-0-2026-102164)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0196
Summary
On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:07 UTC
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102164",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:07:46.593021Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:54.692Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eVXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client.\u003c/p\u003e"
}
],
"value": "VXLAN tunnelling with L2-proxy must be enabled. This is a non-default configuration. If L2-proxy is not configured, the access point is not exposed to this vulnerability. The issue can be triggered either from the LAN or by an associated client."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible.\u003c/p\u003e"
}
],
"value": "On affected Arista access points configured with VXLAN tunnelling and L2-proxy (a specific configuration unique to the VESPA use-case), a wireless client associated to the tunnelled SSID can send a crafted packet, causing the access point to reveal memory contents in network traffic. No write primitive or remote code execution is possible."
}
],
"impacts": [
{
"capecId": "CAPEC-540",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-540 Overread Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:31.913Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24812-security-advisory-0196"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102164 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102164 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0196",
"defects": [
"BUG 1774082"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0196",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure.\u003c/p\u003e"
}
],
"value": "If VXLAN tunnelling with L2-proxy is not required, disabling this configuration eliminates exposure."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102164",
"datePublished": "2026-10-06T19:40:31.913Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:07:54.692Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102163 (GCVE-0-2026-102163)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0195
Summary
On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:07 UTC
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102163",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:07:23.178346Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:33.630Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThe wireless sensor service processes beacon and probe response frames as part of normal operation. Any access point with WIPS or wireless monitoring enabled is potentially exposed because any client in RF vicinity can trigger it.\u003c/p\u003e"
}
],
"value": "The wireless sensor service processes beacon and probe response frames as part of normal operation. Any access point with WIPS or wireless monitoring enabled is potentially exposed because any client in RF vicinity can trigger it."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required.\u003c/p\u003e"
}
],
"value": "On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required."
}
],
"impacts": [
{
"capecId": "CAPEC-100",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-100 Overflow Buffers"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:31.435Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24811-security-advisory-0195"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102163 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102163 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0195",
"defects": [
"BUG 1774048"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0195",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eThere is no mitigation or workaround available.\u003c/p\u003e"
}
],
"value": "There is no mitigation or workaround available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102163",
"datePublished": "2026-10-06T19:40:31.435Z",
"dateReserved": "2026-09-28T17:45:17.722Z",
"dateUpdated": "2026-10-06T20:07:33.630Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102169 (GCVE-0-2026-102169)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:07
VLAI
EPSS
VEX
Title
Security Advisory 0194
Summary
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:06 UTC
CWE
- CWE-476 - NULL Pointer Dereference
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102169",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:06:55.662490Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:07:05.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a captive-portal-enabled SSID can crash the portal service with a crafted HTTP request. The service automatically restarts, but a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-476",
"description": "CWE-476 NULL Pointer Dereference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:30.888Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102169 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102169 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0194",
"defects": [
"BUG 1846913"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0194",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available.\u003c/p\u003e"
}
],
"value": "If Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102169",
"datePublished": "2026-10-06T19:40:30.888Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:07:05.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-102168 (GCVE-0-2026-102168)
Vulnerability from cvelistv5 – Published: 2026-10-06 19:40 – Updated: 2026-10-06 20:06
VLAI
EPSS
VEX
Title
Security Advisory 0194
Summary
On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-06 20:06 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.arista.com/en/support/advisories-noti… | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Arista Networks | Wi-Fi Access Points |
Affected:
22.0.0 , ≤ 22.0.1F-32
(custom)
Affected: 21.3.0 , ≤ 21.3.0M-13 (custom) Affected: 1.0.0 , < 21.3.0 (custom) |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-102168",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-06T20:06:24.609870Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T20:06:39.424Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Wi-Fi Access Points"
],
"product": "Wi-Fi Access Points",
"vendor": "Arista Networks",
"versions": [
{
"lessThanOrEqual": "22.0.1F-32",
"status": "affected",
"version": "22.0.0",
"versionType": "custom"
},
{
"lessThanOrEqual": "21.3.0M-13",
"status": "affected",
"version": "21.3.0",
"versionType": "custom"
},
{
"lessThan": "21.3.0",
"status": "affected",
"version": "1.0.0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability.\u003c/p\u003e"
}
],
"value": "In order to be vulnerable, Captive Portal must be enabled on at least one SSID, along with an associated client and LAN network. If the Captive Portal is not configured, the portal service is not running and the access point is not exposed to this vulnerability."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eOn affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible.\u003c/p\u003e"
}
],
"value": "On affected Arista Wi-Fi access points with Captive Portal enabled, an unauthenticated wireless client connected to a Captive-Portal-enabled SSID can crash the portal service with a crafted HTTP request. This results in a temporary denial of service until the service automatically restarts. Remote code execution is not possible."
}
],
"impacts": [
{
"capecId": "CAPEC-469",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-469 HTTP DoS"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-06T19:40:30.345Z",
"orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"shortName": "Arista"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24810-security-advisory-0194"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eCVE-2026-102168 has been fixed in the following releases:\u003c/p\u003e\u003cul\u003e\u003cli\u003e22.1.1F-61 and later release in the 22.x train\u003c/li\u003e\u003cli\u003e21.4.0M-12 and later releases in the 21.x train\u003c/li\u003e\u003c/ul\u003e"
}
],
"value": "CVE-2026-102168 has been fixed in the following releases:\n- 22.1.1F-61 and later release in the 22.x train\n- 21.4.0M-12 and later releases in the 21.x train"
}
],
"source": {
"advisory": "Security Advisory 0194",
"defects": [
"BUG 1774072"
],
"discovery": "INTERNAL"
},
"title": "Security Advisory 0194",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIf Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available.\u003c/p\u003e"
}
],
"value": "If Captive Portal is not required, disabling Captive Portal on all SSIDs eliminates exposure. If a Captive Portal is required, there is no mitigation available."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
"assignerShortName": "Arista",
"cveId": "CVE-2026-102168",
"datePublished": "2026-10-06T19:40:30.345Z",
"dateReserved": "2026-09-28T17:45:17.723Z",
"dateUpdated": "2026-10-06T20:06:39.424Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}