CVE-2026-102156: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in Arista Networks CloudVision CUE

This vulnerability (CVE-2026-102156) in Arista Networks CloudVision CUE is due to improper neutralization of special elements in LDAP authentication input, classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). An unauthenticated network attacker could potentially inject LDAP queries against the directory service configured in the product, but exploitation requires high complexity. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges or user interaction required, and a confidentiality impact classified as high, with no integrity or availability impact. The affected versions are from 2021.2.0 up to and including 2026.2.0. There is no vendor advisory or patch information provided, and no known exploits in the wild.

Successful exploitation could allow an unauthenticated attacker to inject LDAP queries, potentially leading to unauthorized disclosure of sensitive information from the directory service. The confidentiality impact is high, but integrity and availability are not affected. The attack complexity is high, reducing the likelihood of exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, monitoring vendor communications for updates is recommended. No specific mitigations are indicated in the available data.