CVE Feed

    Dashboard / CVE / CVE-2026-101158

    CVE-2026-101158

    A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

    Published:Oct 6, 2026
    Last Modified:Oct 9, 2026
    EPS:Oct 6, 2026
    EPSS Score:0.00283
    CVSS Score:8.4

    Affected Products

    Vendor
    Arista
    Product
    Cloudvision Portal

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-101155 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101154 (CVSS 8.6) — An authenticated remote attacker with specific permissions can read or write files on the platform filesystem …
    CVE-2026-101153 (CVSS 7.2) — On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability…
    CVE-2026-101152 (CVSS 7.6) — Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker …
    CVE-2026-101151 (CVSS 5.3) — Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL…
    CVE-2026-101150 (CVSS 5.1) — Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to…
    CVE-2026-101149 (CVSS 5.1) — Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to…
    CVE-2026-31431 (CVSS 7.8) — In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating …
    CVE-2025-0505 (CVSS 10) — On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be use…
    CVE-2023-24546 (CVSS 8.1) — On affected versions of the CloudVision Portal improper access controls on the connection from devices to Clou…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High