CVE-2026-101153

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Arista Networks, Inc.

Description

On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101153

EUVD

EUVD-2026-93949

Affected Vendors & Products

Vendor	Product	Version / Range
Arista	Networks	CloudVision Portal 2026.2.0
Arista	Networks	CloudVision Portal 2026.1.0
Arista	Networks	CloudVision Portal 2025.3.0
Arista	Networks	CloudVision Portal 2025.2.0
Arista	Networks	CloudVision Portal 2025.1.0
Arista	Networks	CloudVision Portal 2024.3.0
Arista	Networks	CloudVision Sensor 1.4.0
Arista	Networks	CloudVision Sensor 1.3.0
Arista	Networks	CloudVision Sensor 1.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability is a path traversal issue in CloudVision Portal (on-premises) or CloudVision Sensor. An authenticated user with high privileges can exploit it to extract unintended data from the Sensor by accessing files outside their intended directory.

Detection Guidance

Detection requires checking for unauthorized data extraction attempts from CloudVision Sensor. Monitor logs for unusual file access patterns or path traversal sequences like '../' in requests. Review network traffic for suspicious outbound connections from CloudVision Portal/Sensor to unexpected destinations.

Impact Analysis

If exploited, this vulnerability could allow unauthorized access to sensitive data stored on the Sensor, potentially leading to data breaches or information leaks. It may also enable attackers to retrieve confidential files or system configurations.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health data. Organizations may face legal penalties, reputational damage, and loss of customer trust due to unauthorized data access.

Mitigation Strategies

Immediately update CloudVision Portal and Sensor to the latest patched versions to address the path traversal vulnerability. Restrict high-privilege user access to only necessary personnel and monitor for unusual data extraction activities.

Hi! I’m here to help you understand CVE-2026-101153. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70