Arista Networking Software EUVD-2026-93961

Exploitation requires (1) adjacent-network access to the vulnerable Arista interface rather than arbitrary internet reach (CVSS AV:A), and (2) an authenticated user subsequently viewing the attacker-injected stored content (UI:A) - the payload does not fire on injection alone. The attacker needs no authentication or privileges to plant the content (PR:N). The specific input field, feature, or configuration page where content is stored is not named in the provided advisory excerpt and should be confirmed against Arista advisory 0192. The requirement for a separate authenticated victim to render the content is the principal factor limiting real-world exploitation.

Arista PSIRT rates this stored XSS at CVSS 4.0 base 9.3 (Critical). The vector (AV:A/AC:L/AT:N/PR:N/UI:A) indicates adjacent-network reach, low complexity, no attacker privileges, but mandatory interaction by a victim who must view the injected content - so despite the 9.3, exploitation is gated by two real-world limiters: an adjacent-network foothold (not internet-wide reach) and a separate authenticated user triggering the payload. The high score is driven largely by the scope/subsequent-system impact (SC:H/SI:H) that stored XSS inflicts when the payload runs inside a privileged user's authenticated session. No EPSS score, no CISA KEV listing, and no public POC were supplied in the input, so there is no exploitation-probability or in-the-wild signal to corroborate the vendor's severity - treat the 9.3 as impact-driven potential rather than demonstrated active risk. The affected Arista product and versions are not identified in the provided data (only a single advisory link), which is the largest gap in assessing true priority.

An attacker on the same adjacent network (e.g., a shared management or data-center segment) submits a crafted payload into a field whose input is stored and later rendered without sanitization. When an authenticated administrator subsequently opens the affected page, the stored script executes in their browser under their session, letting the attacker hijack the session, read sensitive data, or alter system state. No public exploit code was identified in the provided data.