Arista CV-CUE EUVD-2026-93956

Exploitation requires network reachability to the CV-CUE backend's internal-service functionality; the flaw is a missing authentication check (CWE-306) on functions intended only for internal services, so no credentials, configuration change, or user interaction is needed (PR:N/UI:N/AC:L). The practical limiting factor is network exposure: if the affected internal endpoints are segmented, firewalled, or only reachable from a trusted management network rather than exposed to untrusted networks, the realistic attack surface shrinks substantially. Impact is bounded to the functionality those internal services expose - per the description, sensitive location information disclosure and/or service disruption. Specific affected and fixed versions are not provided in the input and should be obtained from the Arista advisory.

This is a genuine high-priority issue based on the exploitability signals, though some impact claims warrant scrutiny. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes the worst-case exposure profile: fully remote, low-complexity, no authentication, no user interaction - consistent with CWE-306 (Missing Authentication for a Critical Function) and the 'Authentication Bypass' tag. That combination is exactly what makes access-control flaws attractive to attackers, and the 9.3 score reflects it. However, the real-world risk is tempered by missing corroboration: there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. There is also an internal tension between the CVSS vector and the description: the vector asserts VC:H/VI:H/VA:H (full confidentiality, integrity, and availability impact), but the description only substantiates confidentiality ('expose sensitive location information') and availability ('disrupt affected services') - it does not describe any integrity/data-modification impact, so VI:H appears to be an upper-bound assumption rather than a described outcome; verify with Arista. Net: treat as a serious, prioritize-for-patching vulnerability because of the unauthenticated network-reachable access-control break, but recognize the severity rating is vendor-assigned worst-case rather than exploitation-proven.

A remote, unauthenticated attacker who can reach the CV-CUE backend over the network sends requests to functionality that was intended to be callable only by internal services, bypassing the missing authentication check. Because no credentials or user interaction are required, the attacker can either retrieve sensitive location data served by those internal endpoints or issue requests that disrupt the service. No public proof-of-concept is identified in the available data, so exploitation would currently require independent research.