CloudVision CUE EUVD-2026-93960

Exploitation requires an authenticated, high-privilege administrator account to store the malicious content in a CloudVision CUE configuration (PR:H) - this is not a remote unauthenticated flaw. Payload execution additionally requires a second authenticated user to actively view or compare (UI:A) the affected configuration; it does not fire automatically. These two factors - insider-level admin privilege to plant the payload and required victim interaction to trigger it - are the primary limits on realistic exploitation, confining the threat largely to a malicious or compromised administrator targeting other operators of the same platform.

This is a stored XSS (CWE-79) in Arista CloudVision CUE that scores a medium 6.2 under the vendor-supplied CVSS 4.0 vector. The signals are internally consistent and point to a comparatively low real-world priority rather than an urgent one. The vector is network-reachable (AV:N) with low attack complexity (AC:L), but it requires the highest privilege level (PR:H) - i.e. an authenticated, high-privilege administrator must plant the payload - and it requires active victim interaction (UI:A), since a second authenticated user must view or compare the poisoned configuration. Notably there is NO direct impact on the vulnerable system itself (VC:N/VI:N/VA:N); all impact is on the subsequent system (SC:H/SI:H/SA:H), reflecting that the payload executes in the victim's authenticated browser session. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so there is no public exploit identified at time of analysis. The dominant risk reducer is the insider-level prerequisite: an attacker must already hold high-privilege admin access, which both narrows the realistic threat to a malicious or compromised admin and limits widespread opportunistic exploitation. Key missing data: no EPSS probability and no independent exploitation evidence were supplied, so exploitation likelihood cannot be quantified from this input.

A malicious or compromised high-privilege administrator injects a crafted script payload into a CloudVision CUE configuration field. When another authenticated operator later opens or runs a comparison on that configuration, the stored script executes in their browser session, letting the attacker act as that user to read sensitive data, alter configurations, or disrupt managed wireless services. No public exploit code was provided in the input, so this is a plausible scenario rather than a demonstrated one.