CVE-2026-102160: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Arista Networks CloudVision CUE

This vulnerability (CVE-2026-102160) involves improper neutralization of special elements used in OS commands (CWE-78) within the backup management functionality of Arista Networks CloudVision CUE. An authenticated Super User can craft a backup request that leads to execution of arbitrary OS commands with the privileges of the service running CloudVision CUE. The vulnerability affects versions >=2021.2.0 and <=2026.2.0. The CVSS 3.1 base score is 7.2, indicating high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation allows an authenticated Super User to execute arbitrary operating system commands with the privileges of the CloudVision CUE service. This can lead to full compromise of the affected system, including unauthorized data access, modification, or service disruption. The impact is rated high due to the potential for complete system control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Super User access to trusted personnel only and monitor backup request activities closely. Avoid submitting untrusted or malformed backup requests. Follow vendor communications for updates on patches or mitigations.