Arista CloudVision CVE-2026-101153

Exploitation requires an authenticated session as a user with sufficiently high privileges on an on-premises CloudVision Portal deployment or on a CloudVision Sensor (cloud-hosted CloudVision is not named as affected). The attacker must be able to supply file-path input to the Sensor data-access functionality and reach it over the network (AV:N). Key limiting factors: the PR:H requirement restricts this to trusted administrators or a compromised high-privilege account, there is no unauthenticated or low-privilege path, and the vendor's AC:H rating implies additional non-trivial preconditions must be met for a successful traversal.

This is a moderate, not top-tier, priority. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N, score 7.2) makes the dominant limiting factor explicit: PR:H means exploitation requires an already-authenticated user holding high privileges, so this is fundamentally a trust-boundary / insider-or-compromised-admin issue rather than a remotely-reachable unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public POC were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a privilege-gated path traversal that is unattractive for mass automation. Two signals in the input conflict and should be verified with Arista: (1) the vendor marks AC:H (high complexity), yet a path traversal to read files is typically low-complexity once the attacker is authenticated - the AC:H may reflect non-obvious preconditions not stated in the terse description; and (2) the 4.0 vector asserts subsequent-system impact SC:H/SI:H/SA:H and VI:N/VA:N, which is internally odd because the description only describes reading ('extract unintended data') with no integrity or availability effect - the high subsequent-system scores are not substantiated by the one-line description and should not be treated as confirmed. Net: a real but privilege-constrained confidentiality exposure best handled on a normal patch cycle, not an emergency.

A user who already holds high privileges on an on-premises CloudVision Portal or CloudVision Sensor supplies a crafted file path containing traversal sequences to a Sensor data-access function, causing the system to return files outside the intended directory. The attacker uses this to read unintended data (e.g., configuration or other sensitive files) from the Sensor. No public exploit code is known, and the high-privilege requirement means the actor must first be a trusted or compromised operator.