CloudVision CUE CVE-2026-102156

The affected CloudVision CUE instance must be configured to perform LDAP authentication against an external directory service - the injection targets 'the configured directory service', so a deployment without LDAP/directory integration is not exposed. Exploitation is further limited by CVSS AC:H: the attacker must satisfy specific conditions outside their control (likely particular directory schema, query construction, or timing behavior), which meaningfully raises the bar beyond a trivial request. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the impact is confined to confidentiality of the downstream directory service (SC:H); CloudVision CUE itself suffers no direct confidentiality, integrity, or availability impact.

This is a moderate-priority issue, not a top-tier emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N) describes a network-reachable, unauthenticated LDAP injection, but AC:H signals that exploitation depends on conditions outside the attacker's control, dampening real-world likelihood. Critically, the impact profile is unusual: the vulnerable system itself takes no confidentiality, integrity, or availability impact (VC:N/VI:N/VA:N), and the only material impact is SC:H - confidentiality of the subsequent/downstream system, i.e. the configured directory service whose LDAP queries can be manipulated. The 6.9 (Medium) score reflects this scoped-but-limited impact. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active exploitation or widespread weaponization; combined with AC:H this points toward a theoretical-to-targeted risk rather than mass exploitation. No signals conflict here, but note the absence of EPSS/KEV/POC data means exploitation likelihood is inferred from the CVSS vector alone.

A remote, unauthenticated attacker submits crafted input to the LDAP authentication interface of an Arista CloudVision CUE instance that is configured to authenticate against an external directory service. Because the input is improperly neutralized, the attacker injects additional LDAP query syntax that is executed against the backend directory, enabling disclosure of directory information. The high attack complexity means the attacker must satisfy specific conditions (e.g. particular directory configuration or query behavior), and no public exploit code is identified at time of analysis.