Arista EOS CVE-2026-101154

Exploitation requires an authenticated account on the Arista platform that holds the 'specific permissions' needed to interact with the Network Provisioning Image Repository (CVSS PR:H confirms high-privilege access). The attack vector is the image repository's file-handling: crafted requests and/or crafted file uploads carrying path-traversal sequences that escape the intended storage scope. Limiting factors: the attacker must already possess valid credentials with image-repository privileges, which substantially reduces the exploitable population to insiders or attackers who have already compromised a privileged account; no user interaction is required (UI:N) and no non-default feature toggle is stated, but access is gated behind that privileged role.

This is a credible mid-to-high priority issue but not a drop-everything emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.6) indicates network-reachable, low-complexity exploitation with full confidentiality, integrity, and availability impact on the vulnerable system, but crucially requires PR:H - high privileges on the platform. The description reinforces this: an 'authenticated remote attacker with specific permissions' is the precondition, so this is a privilege-boundary/path-traversal escape rather than an unauthenticated breach. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation or weaponization - the elevated score is driven by impact, not by demonstrated real-world attack activity. Signals are internally consistent (CVSS network vector aligns with the 'remote attacker' description), so there is no conflict to flag; the main caveat is that the high-privilege requirement meaningfully narrows the realistic attacker population to users who already hold an account with image-repository permissions.

An attacker who already holds an authenticated account with image-repository permissions on the Arista platform sends specially crafted requests or uploads a maliciously named file to the Network Provisioning Image Repository, using path-traversal sequences to escape the intended directory. This lets them read sensitive files elsewhere on the filesystem or write/overwrite files outside the repository, potentially corrupting platform data or planting malicious content. No public exploit code is identified in the provided data, so exploitation currently requires custom tooling.