VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible.
Hosted, including Dedicated, versions of VCO were impacted and have already been patched.
CVE-2026-102165 is a stack-based buffer overflow vulnerability in Arista Networks Wi-Fi Access Points. An unauthenticated attacker with network access to the capture service can send a specially crafted packet to cause the service to crash or potentially execute remote code. Exploitation requires use of a non-default streaming mode that is uncommonly enabled. The vulnerability affects multiple versions of the product up to 22.0.1F-32. The CVSS score is 7.5, indicating high severity.
CVE-2026-102167 is a stack-based buffer overflow vulnerability in Arista Networks Wi-Fi Access Points affecting certain firmware versions. It allows an unauthenticated attacker on the same network segment as the wired uplink to cause memory corruption that can crash the sensor service or potentially enable remote code execution. The vulnerability has a high severity with a CVSS score of 7.5. No explicit patch or remediation details are provided in the available data.
CVE-2026-102164 is an out-of-bounds read vulnerability (CWE-125) affecting Arista Networks Wi-Fi Access Points when configured with VXLAN tunnelling and L2-proxy in the VESPA use-case. A wireless client connected to the tunnelled SSID can send a crafted packet that causes the access point to leak memory contents in network traffic. This vulnerability does not allow write access or remote code execution. The CVSS score is 3.1, indicating low severity.
CVE-2026-102163 is a high-severity out-of-bounds write vulnerability (CWE-787) affecting Arista Networks Wi-Fi Access Points with Wireless Intrusion Prevention System (WIPS) enabled. An unauthenticated attacker within radio frequency proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring or potentially achieving remote code execution. No wireless association or authentication is required to exploit this vulnerability.
CVE-2026-102169 is a medium severity vulnerability affecting Arista Networks Wi-Fi Access Points with Captive Portal enabled. An unauthenticated wireless client connected to a captive-portal-enabled SSID can send a crafted HTTP request that causes a NULL pointer dereference, crashing the portal service. Although the service restarts automatically, a sustained low-rate attack can cause a persistent denial of service of the captive portal. Remote code execution is not possible.
CVE-2026-102168 is an integer underflow vulnerability affecting Arista Networks Wi-Fi Access Points with Captive Portal enabled. An unauthenticated wireless client connected to such an SSID can send a crafted HTTP request that crashes the portal service, causing a temporary denial of service until the service restarts automatically. Remote code execution is not possible. The vulnerability affects multiple versions of the product as specified. The CVSS score is 6.5, indicating a medium severity impact focused on availability.
A stack-based buffer overflow vulnerability exists in Arista Networks Wi-Fi Access Points when captive portal or application firewall is enabled on at least one SSID. An unauthenticated network-adjacent attacker can send a crafted packet to the wireless gateway service, triggering a stack overflow that may cause denial-of-service or arbitrary code execution. The wireless gateway service restarts automatically after a crash, enabling repeated exploitation attempts.
CVE-2026-101157 is a stored cross-site scripting (XSS) vulnerability in Arista Networks CloudVision CUE. It allows an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views the affected content. Exploitation can compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt services. The vulnerability affects versions from 2021.2.0 through 2026.2.0. It has a high severity with a CVSS score of 8.7.
CVE-2026-101156 is a stored cross-site scripting (XSS) vulnerability in Arista Networks CloudVision CUE that affects versions from 2025.2.0 through 2026.2.0. An authenticated high-privilege administrator can store malicious content in configurations, which may execute in the browsers of other authenticated users viewing or comparing those configurations. Exploitation could allow attackers to leverage the victim's browser session to access sensitive data, modify configurations, or disrupt wireless services.
CVE-2026-102156 is a vulnerability in Arista Networks CloudVision CUE involving improper neutralization of LDAP authentication input. This flaw could allow an unauthenticated network attacker to inject LDAP queries under complex conditions. The vulnerability affects versions from 2021.2.0 through 2026.2.0. It has a CVSS v3.1 score of 6.8, indicating medium severity. No known exploits are reported in the wild, and no patch information is currently provided.
CVE-2026-102161 is a high-severity vulnerability in Arista Networks CloudVision CUE that involves the use of hard-coded credentials. An unauthenticated attacker on an adjacent private network or routed through a reverse proxy can forge their source IP address to gain administrative session privileges on the CV-CUE backend. This vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. The vulnerability has a CVSS score of 8.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-102160 is an OS command injection vulnerability in Arista Networks CloudVision CUE backup management. It allows an authenticated Super User to submit a crafted backup request that could execute arbitrary OS commands with the privileges of the affected service. The vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. The CVSS 3.1 base score is 7.2, indicating a high severity level. No public exploits are known, and no vendor patch information is provided in the input data.
CVE-2026-102159 is a critical access-control vulnerability in Arista Networks CloudVision CUE. It involves missing authentication for a critical backend function, allowing unauthenticated network attackers to access internal service functionality. Exploitation can lead to exposure of sensitive location information and disruption of affected services. The vulnerability affects versions from 2022.3.0 through 2026.2.0 inclusive. The CVSS score is 9.8, indicating a critical severity level.
CVE-2026-102158 is a medium severity vulnerability in Arista Networks CloudVision CUE where improper validation of certain API request parameters allows an authenticated network user to perform SQL injection attacks against the backend. This vulnerability impacts the availability of the backend system but does not affect confidentiality or integrity. It affects versions from 2022.2.0 through 2026.2.0 inclusive. No known exploits are reported in the wild, and no patch information is provided in the available data.
CVE-2026-102157 is an insecure direct object reference (IDOR) vulnerability in Arista Networks CloudVision CUE's file-serving interface. It may allow an authenticated network user, under specific conditions, to access another user's transient data. The vulnerability affects versions from 2021.2.0 through 2026.2.0. The CVSS score is 5.9, indicating medium severity. There are no known exploits in the wild and no patch information is provided.
CVE-2026-102155 is an XML External Entity (XXE) injection vulnerability in the WiFi-server Spectralight application component of Arista Networks CloudVision CUE. It allows any authenticated user to send crafted XML requests that can disclose arbitrary local files and cause partial denial of service. The vulnerability affects versions from 2021.2.0 through 2026.2.0 inclusive. It has a high severity with a CVSS score of 8.5. No patch or remediation details are provided, and no known exploits are reported in the wild.
CVE-2026-101155 is a critical path traversal vulnerability in Arista Networks CloudVision Portal. An authenticated remote attacker with specific permissions can exploit this flaw to read or write files outside the intended directory scope via crafted requests or file uploads in the Software Management Studio Software Repository. The vulnerability affects multiple versions from 2024.2.0 through 2026.2.0. It has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-101154 is a path traversal vulnerability in Arista Networks CloudVision Portal that allows an authenticated remote attacker with specific permissions to read or write files outside the intended directory scope. This occurs through specially crafted requests or file uploads to the Network Provisioning Image Repository. The vulnerability affects multiple versions of CloudVision Portal from 2018.1.0 through 2026.2.0. It has a high severity rating with a CVSS score of 7.2, indicating significant confidentiality, integrity, and availability impacts. No known exploits are reported in the wild, and no patch links are provided in the available data. The product is not a cloud service, so remediation depends on vendor advisories. The vulnerability is identified as CWE-22, improper limitation of a pathname to a restricted directory.
CVE-2026-101153 is a path traversal vulnerability in Arista Networks CloudVision Portal (on-premises) and CloudVision Sensor. It allows an authenticated user with high privileges to access unintended data by exploiting improper limitation of pathnames. The vulnerability affects multiple versions from 1.0.0 up to 2026.2.0. The CVSS score is 8.0, indicating high severity with significant confidentiality, integrity, and availability impacts.