Arista CloudVision Portal: Stored cross-site scripting in Fileserver upload API
Summary
An authenticated attacker with file upload privileges can store malicious script in the Fileserver upload API of CloudVision Portal (on-premises). When another CloudVision user views the content, the script can hijack that user's web session, potentially granting full access to the account and its administrative permissions. The issue is present in the default configuration of the affected releases, and CISA SSVC rates technical impact as total.
Affected
- CloudVision Portal 2026.2.0
- CloudVision Portal 2026.1.0 to 2026.1.2
- CloudVision Portal 2025.3.0 to 2025.3.3
- CloudVision Portal 1.0.0 to before 2025.3.0
- CV-CUE (on-premises) releases that ship with the affected CloudVision Portal versions
- CloudVision as-a-Service and CV-CUE cloud service are not affected according to the vendor
Fixed in
- 2026.2.1 and later (2026.2.x train)
- 2026.1.3 and later (2026.1.x train)
- 2025.3.4 and later (2025.3.x train)
- Fixed release for versions before 2025.3.0: Unknown.
Workaround
- The vendor reports no mitigation is available.
- Restrict roles with file upload permissions to trusted users. Review roles with 'Read and Write' permission on Bug Alert Management, File, Packaging and Image Repository under Settings > Roles, and check Settings > Users.
Exploitation
- Known exploited: No (per the sources reviewed).
- Public proof of concept: none found.
- EPSS: 0.00283.
- CISA SSVC: Exploitation none, automatable no, technical impact total.
Our recommendation
- Upgrade CloudVision Portal to a fixed release for your train (2026.2.1, 2026.1.3 or 2025.3.4 and later).
- Plan an upgrade path for versions before 2025.3.0 and check Arista's upgrade documentation.
- Until patched, limit file upload rights to trusted users and review the listed roles.
- Check whether the management interface is reachable from the internet and restrict access.
- Monitor for unusual file uploads and session activity.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Arista Security Advisory 0185 www.arista.com
- Arista Security Advisory 0184 www.arista.com
- Vulners CIRCL record CVE-2026-101158 vulners.com
- Vulners Arista ARISTA:0185 vulners.com
- Strix CVE-2026-101158 www.strix.ai
- HOL Guard CVE-2026-101158 hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:13.
Original description (NVD)
A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.