Arista CloudVision CUE: Missing authentication in CV-CUE backend

Summary

An access-control flaw in the CV-CUE backend of Arista CloudVision CUE on-premises deployments may allow an unauthenticated network attacker to reach functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services. The flaw only applies when the CV-CUE backend (wifimanager) is enabled and running; the vendor states the cloud service is not affected.

Affected

• Arista CloudVision CUE on-premises (virtual or physical appliance, packaged with CloudVision Portal)
• Versions 2022.3.0 to 2026.2.0
• Default configuration: unaffected; vulnerable only if wifimanager is enabled and running
• Cloud service: not affected according to the vendor

Fixed in

• Upgrade to 2026.2.1 or later

Workaround

• No vendor-listed workaround or mitigation available.
• Check whether wifimanager is running with: cvpi status wifimanager
• If CV-CUE is not in use, stopping wifimanager removes the precondition; this is not vendor-stated and must be tested with Arista support first, as Wi-Fi management will stop.

Exploitation

• Discovered internally by Arista; the vendor is not aware of malicious exploitation in customer networks.
• The vendor reports no indicators of compromise.
• Not listed in CISA KEV.
• Third-party trackers list EPSS at 0.36%; no public exploits found in Exploit-DB. No public proof of concept found on GitHub (negative search result).
• CISA SSVC: exploitation none, automatable yes, technical impact total.

Our recommendation

• Check whether CV-CUE on-premises is deployed and whether wifimanager is running.
• Upgrade affected appliances to 2026.2.1 or later, following the upgrade guidance in the CloudVision Users Manual.
• Ensure the appliance is not reachable from the internet, guest networks or broad internal segments; restrict access to a management network.
• Give high priority if the appliance is reachable beyond a management network; otherwise apply in the normal patch cycle after confirming the version.
• Review appliance logs for unusual access as a precaution.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Arista Security Advisory 0190 www.arista.com
• Arista Security Advisory 0191 www.arista.com
• Canadian Centre for Cyber Security AV26-1015 www.cyber.gc.ca
• OpenCVE CVE-2026-102159 app.opencve.io
• Strix CVE-2026-102159 www.strix.ai
• Cyber-Defence CVE-2026-102159 www.cyber-defence.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:13.