CVE-2026-101157: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Arista Networks CloudVision CUE

CVE-2026-101157 is a stored cross-site scripting (CWE-79) vulnerability in Arista Networks CloudVision CUE that allows an unauthenticated attacker with adjacent-network access to inject malicious scripts. These scripts execute in the context of an authenticated user's browser when viewing the affected content. This can lead to session compromise, unauthorized data access, system state modification, or service disruption. The vulnerability affects versions >=2021.2.0 and <=2026.2.0. The CVSS 3.1 vector indicates low attack complexity, no privileges required, user interaction required, and a scope change with high confidentiality and integrity impact and low availability impact. No vendor advisory or patch information is available, and no known active exploitation is reported.

Successful exploitation can compromise authenticated browser sessions, allowing attackers to access sensitive data, modify system state, or disrupt services. The vulnerability requires adjacent-network access and user interaction (viewing malicious content). The impact is high on confidentiality and integrity, with some impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, monitor Arista Networks advisories for updates. Until a fix is available, limit adjacent-network access and restrict exposure of the affected CloudVision CUE interface to trusted users only.