{"schema_version":1,"title":"Arista CloudVision Portal vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 18 vulnerabilities in Arista CloudVision Portal: 0 in the last 7 days and 17 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102161, was published on 6 October 2026. Nothing in the last four weeks, down from 17 vulnerabilities in the four before. 0 critical against 2.","url":"https://junglewise.ai/threats/technologies/cloudvision-portal","json_url":"https://junglewise.ai/threats/technologies/cloudvision-portal.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/cloudvision-portal","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":10,"all_time":18,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":17,"last_365_days":17},"latest":[{"cve":"CVE-2026-102161","cvss":8.8,"slug":"cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private","title":"Arista CloudVision CUE authentication bypass via IP spoofing","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:11.23+00:00","url":"https://junglewise.ai/threats/cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private"},{"cve":"CVE-2026-102160","cvss":7.2,"slug":"cve-2026-102160-an-operating-system-os-command-injection-vulnerability-in","title":"Arista CloudVision CUE OS command injection in backup management","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:11.1+00:00","url":"https://junglewise.ai/threats/cve-2026-102160-an-operating-system-os-command-injection-vulnerability-in"},{"cve":"CVE-2026-102159","cvss":9.8,"slug":"cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an","title":"Arista CloudVision-CUE access control bypass in backend","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:10.963+00:00","url":"https://junglewise.ai/threats/cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an"},{"cve":"CVE-2026-102158","cvss":6.5,"slug":"cve-2026-102158-improper-validation-of-selected-cloudvision-cue-application","title":"Arista CloudVision CUE SQL injection in API parameter validation","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:10.837+00:00","url":"https://junglewise.ai/threats/cve-2026-102158-improper-validation-of-selected-cloudvision-cue-application"},{"cve":"CVE-2026-102157","cvss":5.9,"slug":"cve-2026-102157-an-insecure-direct-object-reference-idor-vulnerability-in-a","title":"Arista CloudVision CUE IDOR in file-serving interface","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:10.7+00:00","url":"https://junglewise.ai/threats/cve-2026-102157-an-insecure-direct-object-reference-idor-vulnerability-in-a"},{"cve":"CVE-2026-102156","cvss":6.8,"slug":"cve-2026-102156-improper-neutralization-of-lightweight-directory-access-protocol","title":"Arista CloudVision CUE LDAP injection","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:10.547+00:00","url":"https://junglewise.ai/threats/cve-2026-102156-improper-neutralization-of-lightweight-directory-access-protocol"},{"cve":"CVE-2026-102155","cvss":8.5,"slug":"cve-2026-102155-an-xml-external-entity-xxe-injection-vulnerability-in-the-wifi","title":"Arista CloudVision CUE XXE injection in Spectralight","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:10.4+00:00","url":"https://junglewise.ai/threats/cve-2026-102155-an-xml-external-entity-xxe-injection-vulnerability-in-the-wifi"},{"cve":"CVE-2026-101158","cvss":8.4,"slug":"cve-2026-101158-a-missing-input-validation-vulnerability-in-the-fileserver","title":"Arista CloudVision Portal stored XSS in file upload API","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:10.127+00:00","url":"https://junglewise.ai/threats/cve-2026-101158-a-missing-input-validation-vulnerability-in-the-fileserver"},{"cve":"CVE-2026-101157","cvss":8.7,"slug":"cve-2026-101157-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an","title":"Arista CloudVision Portal stored XSS vulnerability","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.983+00:00","url":"https://junglewise.ai/threats/cve-2026-101157-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an"},{"cve":"CVE-2026-101156","cvss":8.4,"slug":"cve-2026-101156-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an","title":"Arista CloudVision Portal stored XSS in configuration","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.837+00:00","url":"https://junglewise.ai/threats/cve-2026-101156-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an"},{"cve":"CVE-2026-101155","cvss":9.1,"slug":"cve-2026-101155-an-authenticated-remote-attacker-with-specific-permissions-can","title":"Arista CloudVision Portal path traversal in software repository","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:09.703+00:00","url":"https://junglewise.ai/threats/cve-2026-101155-an-authenticated-remote-attacker-with-specific-permissions-can"},{"cve":"CVE-2026-101154","cvss":7.2,"slug":"cve-2026-101154-an-authenticated-remote-attacker-with-specific-permissions-can","title":"Arista CloudVision Portal path traversal in Network Provisioning Image Repository","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.567+00:00","url":"https://junglewise.ai/threats/cve-2026-101154-an-authenticated-remote-attacker-with-specific-permissions-can"},{"cve":"CVE-2026-101153","cvss":8,"slug":"cve-2026-101153-on-affected-versions-of-cloudvision-portal-on-premises-or","title":"Arista CloudVision path traversal in sensor","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.4+00:00","url":"https://junglewise.ai/threats/cve-2026-101153-on-affected-versions-of-cloudvision-portal-on-premises-or"},{"cve":"CVE-2026-101152","cvss":8,"slug":"cve-2026-101152-insufficient-validation-in-the-single-sign-on-sso-login-flow","title":"Arista CloudVision Portal SSO credential redirection","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.243+00:00","url":"https://junglewise.ai/threats/cve-2026-101152-insufficient-validation-in-the-single-sign-on-sso-login-flow"},{"cve":"CVE-2026-101151","cvss":4.3,"slug":"cve-2026-101151-insufficient-validation-of-request-in-login-flow-could-allow-a","title":"Arista CloudVision Portal open redirect in login flow","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:09.093+00:00","url":"https://junglewise.ai/threats/cve-2026-101151-insufficient-validation-of-request-in-login-flow-could-allow-a"},{"cve":"CVE-2026-101150","cvss":4.1,"slug":"cve-2026-101150-insufficient-validation-of-oidc-bearer-token-configuration-could","title":"Arista CloudVision Portal OIDC bearer token SSRF","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:08.937+00:00","url":"https://junglewise.ai/threats/cve-2026-101150-insufficient-validation-of-oidc-bearer-token-configuration-could"},{"cve":"CVE-2026-101149","cvss":4.1,"slug":"cve-2026-101149-insufficient-validation-of-oidc-sso-provider-configuration-could","title":"Arista CloudVision Portal OIDC SSO configuration SSRF","severity":"medium","exploited":false,"published_at":"2026-10-06T20:17:08.773+00:00","url":"https://junglewise.ai/threats/cve-2026-101149-insufficient-validation-of-oidc-sso-provider-configuration-could"},{"cve":"CVE-2016-9012","cvss":8.8,"slug":"cve-2016-9012-arista-cloudvision-portal-access-control-bypass-in-management","title":"Arista CloudVision Portal access control bypass in management plane","severity":"high","exploited":false,"published_at":"2017-01-23T21:59:02.643+00:00","url":"https://junglewise.ai/threats/cve-2016-9012-arista-cloudvision-portal-access-control-bypass-in-management"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":2,"exploited":0,"vulnerabilities":17},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Arista EOS","slug":"eos","vulnerabilities":73,"url":"https://junglewise.ai/threats/technologies/eos"},{"name":"Arista Wi-Fi Access Point","slug":"wi-fi-access-point","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/wi-fi-access-point"},{"name":"Arista CloudEOS","slug":"cloudeos","vulnerabilities":5,"url":"https://junglewise.ai/threats/technologies/cloudeos"},{"name":"Arista cEOS-lab","slug":"ceos-lab","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/ceos-lab"},{"name":"Arista Velocloud Edge","slug":"velocloud-edge","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/velocloud-edge"},{"name":"Arista vEOS-lab","slug":"veos-lab","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/veos-lab"}],"technology":{"hub":true,"name":"Arista CloudVision Portal","slug":"cloudvision-portal","vendor":{"hub":true,"name":"Arista","slug":"arista","url":"https://junglewise.ai/threats/vendors/arista"},"aliases":[],"category":"network-management-software","homepage":"https://www.arista.com/en/products/cloudvision","description":"Network management and visibility platform for Arista cloud networking infrastructure.","url":"https://junglewise.ai/threats/technologies/cloudvision-portal"},"most_severe":[{"cve":"CVE-2026-102159","cvss":9.8,"slug":"cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an","title":"Arista CloudVision-CUE access control bypass in backend","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:10.963+00:00","url":"https://junglewise.ai/threats/cve-2026-102159-an-access-control-flaw-in-the-cv-cue-backend-may-allow-an"},{"cve":"CVE-2026-101155","cvss":9.1,"slug":"cve-2026-101155-an-authenticated-remote-attacker-with-specific-permissions-can","title":"Arista CloudVision Portal path traversal in software repository","severity":"critical","exploited":false,"published_at":"2026-10-06T20:17:09.703+00:00","url":"https://junglewise.ai/threats/cve-2026-101155-an-authenticated-remote-attacker-with-specific-permissions-can"},{"cve":"CVE-2026-102161","cvss":8.8,"slug":"cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private","title":"Arista CloudVision CUE authentication bypass via IP spoofing","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:11.23+00:00","url":"https://junglewise.ai/threats/cve-2026-102161-an-unauthenticated-attacker-located-on-an-adjacent-private"},{"cve":"CVE-2016-9012","cvss":8.8,"slug":"cve-2016-9012-arista-cloudvision-portal-access-control-bypass-in-management","title":"Arista CloudVision Portal access control bypass in management plane","severity":"high","exploited":false,"published_at":"2017-01-23T21:59:02.643+00:00","url":"https://junglewise.ai/threats/cve-2016-9012-arista-cloudvision-portal-access-control-bypass-in-management"},{"cve":"CVE-2026-101157","cvss":8.7,"slug":"cve-2026-101157-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an","title":"Arista CloudVision Portal stored XSS vulnerability","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.983+00:00","url":"https://junglewise.ai/threats/cve-2026-101157-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an"},{"cve":"CVE-2026-102155","cvss":8.5,"slug":"cve-2026-102155-an-xml-external-entity-xxe-injection-vulnerability-in-the-wifi","title":"Arista CloudVision CUE XXE injection in Spectralight","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:10.4+00:00","url":"https://junglewise.ai/threats/cve-2026-102155-an-xml-external-entity-xxe-injection-vulnerability-in-the-wifi"},{"cve":"CVE-2026-101158","cvss":8.4,"slug":"cve-2026-101158-a-missing-input-validation-vulnerability-in-the-fileserver","title":"Arista CloudVision Portal stored XSS in file upload API","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:10.127+00:00","url":"https://junglewise.ai/threats/cve-2026-101158-a-missing-input-validation-vulnerability-in-the-fileserver"},{"cve":"CVE-2026-101156","cvss":8.4,"slug":"cve-2026-101156-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an","title":"Arista CloudVision Portal stored XSS in configuration","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.837+00:00","url":"https://junglewise.ai/threats/cve-2026-101156-a-stored-cross-site-scripting-xss-vulnerability-may-allow-an"},{"cve":"CVE-2026-101153","cvss":8,"slug":"cve-2026-101153-on-affected-versions-of-cloudvision-portal-on-premises-or","title":"Arista CloudVision path traversal in sensor","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.4+00:00","url":"https://junglewise.ai/threats/cve-2026-101153-on-affected-versions-of-cloudvision-portal-on-premises-or"},{"cve":"CVE-2026-101152","cvss":8,"slug":"cve-2026-101152-insufficient-validation-in-the-single-sign-on-sso-login-flow","title":"Arista CloudVision Portal SSO credential redirection","severity":"high","exploited":false,"published_at":"2026-10-06T20:17:09.243+00:00","url":"https://junglewise.ai/threats/cve-2026-101152-insufficient-validation-in-the-single-sign-on-sso-login-flow"}],"generated_at":"2026-11-11T03:07:00.183524+00:00"}