High severity · published Oct 6, 2026
CVE-2026-101156
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration
8.4
CVSS
0.3%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability may allow an authenticated, high-privilege administrator to store malicious content in a configuration. The content may execute in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation may allow the attacker to act through the victim's authenticated browser session to access sensitive data, modify configurations, or disrupt managed wireless services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CloudVision CUE · Arista Networks
2025.2.0 through 2026.2.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101156
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101156
vendor-advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192
More from CloudVision CUE
9.8
CVE-2026-102159
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services
8.8
CVE-2026-102161
An unauthenticated attacker located on an adjacent private network (or any attacker routed through a reverse proxy/load balancer that forwards client headers) can forge their source IP address and gai
8.7
CVE-2026-101157
A stored cross-site scripting (XSS) vulnerability may allow an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views affected
8.5
CVE-2026-102155
An XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application allows any authenticated user to send malicious requests, leading to arbitrary local file disclosure an
7.2
CVE-2026-102160
An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands wi