# CVE-2026-101156: Arista CloudVision Portal stored XSS in configuration

Source: https://junglewise.ai/threats/cve-2026-101156-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-101156 · Severity: high · CVSS 8.4 · Published 2026-10-06

Arista CloudVision Portal, a Wi-Fi and network management service, contains a stored cross-site scripting flaw where privileged administrators can inject malicious code into configuration data. When other authenticated users view or compare these configurations, the injected code executes in their browser, allowing attackers to steal data, modify network settings, or disrupt wireless services.

Technologies: [Arista Cloudvision Portal](https://junglewise.ai/threats/technologies/cloudvision-portal). Vendors: [Arista](https://junglewise.ai/threats/vendors/arista).

## Quick answers

**Is CVE-2026-101156 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-101156 being exploited in the wild.

**How severe is CVE-2026-101156?** High severity, with a CVSS score of 8.4, published 6 October 2026.

**Which products and versions are affected?** Arista Cloudvision Portal 2025.2.0 through 2026.2.0.

**Is there a fix for CVE-2026-101156?** Yes: fixed in 2026.2.1 and later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-101156 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-101156?** Check whether you run Arista Cloudvision Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.2.1 and later

## Technical details

A stored XSS vulnerability (CWE-79) in CloudVision Portal allows authenticated high-privilege administrators to store malicious script content in configuration objects that executes in other authenticated users' browsers during configuration view or comparison operations. Exploitation requires prior administrator authentication, user interaction (viewing configuration), and network access; successful exploitation grants the attacker the ability to act within the victim's authenticated session to access sensitive data, modify system configuration, or disrupt services.

## Affected products

- Arista CloudVision Portal 2025.2.0 through 2026.2.0

## Timeline

- 2026-10-06: disclosed
- 2026-10-06: advisory

## References

- [https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192](https://www.arista.com/en/support/advisories-notices/security-advisory/24808-security-advisory-0192)

## Related threats

- [Arista CloudVision CUE authentication bypass via IP spoofing](https://junglewise.ai/threats/cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private)
- [Arista CloudVision CUE OS command injection in backup management](https://junglewise.ai/threats/cve-2026-102160-an-operating-system-os-command-injection-vulnerability-in)
- [Arista CloudVision-CUE access control bypass in backend](https://junglewise.ai/threats/cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an)
- [Arista CloudVision CUE SQL injection in API parameter validation](https://junglewise.ai/threats/cve-2026-102158-improper-validation-of-selected-cloudvision-cue-application)
- [Arista CloudVision CUE IDOR in file-serving interface](https://junglewise.ai/threats/cve-2026-102157-an-insecure-direct-object-reference-idor-vulnerability-in-a)