Arista CloudVision CVE-2026-101158

Requires a valid authenticated CloudVision account that holds file-upload privileges on the Fileserver upload API (per PR:L); the attacker leverages the API's missing input validation to persist a cross-site scripting payload. Exploitation further depends on victim interaction (UI:A): another CloudVision user - meaningfully impactful only when that user is an administrator - must view the stored malicious content in their browser for the script to execute and the session to be hijacked. Limiting factors: no anonymous/unauthenticated path, the attacker needs upload permission, and the high-impact outcome hinges on an administrative victim actually rendering the payload.

This is a genuine high-priority issue rather than a CVSS-inflated one, but the headline 9.3 should be read with nuance. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A) confirms network reach and low attack complexity, but two gating factors temper raw urgency: PR:L means the attacker must already hold an authenticated CloudVision account with file-upload privileges, and UI:A means a victim user must interact with the malicious content for the stored XSS to fire. The very high score is driven largely by the subsequent-system impacts (SC:H/SI:H/SA:H) reflecting account/session takeover of another - potentially administrative - user. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or at-scale exploitation; the realistic threat is a motivated insider or a foothold attacker escalating laterally, not opportunistic internet-wide exploitation. In short: credible privilege-escalation-to-admin path via stored XSS, verified by the vendor, but exploitation is conditional on prior authenticated access and victim interaction, which lowers the probability of mass exploitation relative to the numeric severity.

An attacker who already holds a low-privileged CloudVision account with file-upload rights abuses the Fileserver upload API, which fails to validate input, to store a malicious XSS payload. When a higher-privileged CloudVision user - ideally an administrator - subsequently views the uploaded content in their browser, the script executes in their session context, letting the attacker steal the session and assume full administrative control. No public exploit code was identified in the provided data, so exploitation would require the attacker to craft the payload themselves.