Software Management Studio CVE-2026-101155

Exploitation requires an authenticated session with the specific permissions needed to interact with the Software Management Studio Software Repository (CVSS PR:H), reached over the network (AV:N) with low complexity and no user interaction. The concrete attack surface is the Software Repository's request handling and file-upload functionality, which fails to constrain paths to the intended scope (CWE-22), allowing both arbitrary read and write on the platform filesystem. The principal limiting factor is the high-privilege prerequisite: an unprivileged or unauthenticated outsider cannot trigger this directly, so realistic risk is concentrated in insider misuse or scenarios where privileged repository credentials have already been compromised.

This is a genuine but conditional priority, not a drive-by threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) and the 8.6 score are driven by full CIA impact on the vulnerable system (VC:H/VI:H/VA:H) via arbitrary file read AND write, but the PR:H requirement is the dominant limiting factor: an attacker must already hold high/specific privileges on the Software Management Studio Software Repository before the path-traversal flaw (CWE-22) becomes exploitable. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - consistent with a vendor-discovered (Arista PSIRT) issue rather than one found through attacks. The subsequent-system metrics are all N (SC:N/SI:N/SA:N), meaning impact is contained to the repository host and there is no automatic lateral scope change. Net: real and worth prioritizing for anyone running this Arista product because write-primitive path traversal can lead to code execution or config tampering, but the high-privilege precondition makes mass, unauthenticated exploitation unlikely; treat it as an insider/post-compromise privilege-boundary escape rather than a perimeter emergency.

An authenticated operator (or an attacker who has already captured credentials with the required repository permissions) sends specially crafted requests or malicious file uploads to the Software Management Studio Software Repository, using '../' path-traversal sequences to read or write files outside the intended repository directory. By writing to sensitive locations on the platform filesystem, the attacker can tamper with configuration or stage code, while reads expose credentials or other protected data. No public proof-of-concept is available in the provided data.