CloudVision Portal EUVD-2026-93947

Exploitation requires a victim to click an attacker-crafted CloudVision Portal login URL and then complete the normal authentication process, at which point the login flow's insufficient request validation redirects the browser to an attacker-specified external site. The attacker needs no credentials (PR:N) but cannot act without victim interaction (UI:P), which is the primary limiting factor; the flaw is in the authentication/login flow itself, so it applies to default-reachable login endpoints of affected CloudVision Portal versions (2020.3.0 through <2025.3.0, 2025.3.0 ≤2025.3.3, 2026.1.0 ≤2026.1.2, and 2026.2.0). Impact is confined to browser redirection with low confidentiality consequence (phishing/credential-theft enablement); no code execution, data modification, or service disruption results.

This is a medium-severity (CVSS 4.0 base 5.3) open redirect (CWE-601) in Arista CloudVision Portal's login flow. The vendor-supplied 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N) shows a network-reachable, low-complexity, unauthenticated flaw, but exploitation hinges on passive user interaction (UI:P) and yields only low confidentiality impact with no integrity or availability impact and no scope/subsequent-system change. These signals are internally consistent and point to a phishing/social-engineering enabler rather than a direct compromise primitive. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input, so there is no evidence of active or probable exploitation; absence of these should not be read as low likelihood but as missing data. Bottom line: a legitimately lower-priority issue - the raw CVSS is deflated-to-medium precisely because impact is limited to redirecting an authenticated user's browser, and the mandatory user click plus low technical impact argue against emergency prioritization, though it should be patched as part of routine maintenance since a vendor fix exists.

An attacker crafts a CloudVision Portal login URL embedding an attacker-controlled external destination and sends it to a legitimate user via phishing. After the victim clicks the link and completes authentication, their browser is silently redirected to the attacker's site, which can harvest credentials via a lookalike page or deliver further social-engineering payloads. No public exploit identified at time of analysis; the attack requires the victim to click and complete login (UI:P).