Quick answers
- Is CVE-2026-101157 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-101157 being exploited in the wild.
- How severe is CVE-2026-101157?
- High severity, with a CVSS score of 8.7, published 6 October 2026.
- Which products and versions are affected?
- Arista Cloudvision Portal 2026.2.0 and all prior releases back to 2021.2.0.
- Is there a fix for CVE-2026-101157?
- Yes: fixed in 2026.2.1 and later releases. Until then: Ensure the CloudVision CUE UI is disabled if not required, which can be verified using the command "cvpi status aware". No other workaround is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-101157 attacked?
- It is attacked from the adjacent network or over the network, in a hosted service.
- Am I affected by CVE-2026-101157?
- Check whether you run Arista Cloudvision Portal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2026.2.1 and later releases
Ensure the CloudVision CUE UI is disabled if not required, which can be verified using the command "cvpi status aware". No other workaround is available.
Technical details
A DOM-based stored XSS vulnerability in Arista CloudVision Portal allows unauthenticated attackers with adjacent-network access to inject malicious content without authentication. The vulnerability affects the CloudVision CUE on-premises UI component and executes when an authenticated user views or accesses the stored malicious content, allowing session hijacking, data theft, configuration modification, or service disruption.
Affected products
- Arista CloudVision Portal 2026.2.0 and all prior releases back to 2021.2.0
Timeline
- 2026-10-06: disclosed
- 2026-10-06: advisory