CloudVision Portal EUVD-2026-93946

Requires an authenticated user holding specific HIGH privileges on Arista CloudVision Portal (PR:H) who can reach and alter the OIDC bearer token configuration; the flaw lies in insufficient validation of that configuration, which permits requests to be directed to arbitrary destinations (SSRF). Limiting factors: exploitation is impossible without pre-existing elevated/administrative access, impact is confined to redirecting requests (subsequent-system confidentiality only, no direct integrity or availability impact), and only CloudVision Portal versions in the affected ranges (2023.3.0 <2025.3.0, 2025.3.0 ≤2025.3.3, 2026.1.0 ≤2026.1.2, and 2026.2.0) are vulnerable. No end-user interaction is required (UI:N), but the privilege gate makes opportunistic or widespread exploitation unlikely.

This is a moderate-severity, low-priority issue rather than an urgent one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N, base 5.1) indicates network-reachable, low-complexity exploitation but requires HIGH privileges (PR:H), which is the dominant limiting factor. All signals align toward low real-world risk: CISA SSVC scores Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'; there is no CISA KEV listing, no EPSS score was provided in the input, and no public exploit was referenced. The only impact in the vector is subsequent-system confidentiality (SC:L) with zero vulnerable-system confidentiality, integrity, or availability impact - consistent with an SSRF (CWE-918) that lets an already-privileged user redirect requests rather than directly compromise the host. Because an attacker must already hold specific high privileges on CloudVision Portal, this is effectively a privilege-abuse/post-authentication weakness, not a pre-auth mass-exploitable flaw. No conflicting signals were found; the main gap is the absence of EPSS data, though every other indicator points to targeted, low-likelihood exploitation.

An attacker who has already obtained high-privilege (e.g., administrative) access to an Arista CloudVision Portal instance abuses the insufficiently validated OIDC bearer token configuration to point authenticated requests at an attacker-chosen or internal destination, enabling server-side request forgery against internal network resources. No public proof-of-concept or exploit code was identified. Exploitation is low-complexity over the network but gated entirely by the requirement that the actor already holds elevated privileges.