CVE-2026-101154

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Arista Networks, Inc.

Description

An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101154

EUVD

EUVD-2026-93950

Affected Vendors & Products

Vendor	Product	Version / Range
Arista	Networks	CloudVision Portal 2026.2.0
Arista	Networks	CloudVision Portal 2026.1.0
Arista	Networks	CloudVision Portal 2025.3.0
Arista	Networks	CloudVision Portal 2018.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability allows an authenticated remote attacker with specific permissions to read or write files on the platform filesystem beyond the intended scope. The attack is performed through specially crafted requests and/or crafted file uploads to the Network Provisioning Image Repository.

Detection Guidance

Detection requires checking for unauthorized file access or modifications in the Network Provisioning Image Repository. Monitor logs for unusual file read/write operations by authenticated users with specific permissions. Inspect file uploads for crafted content.

Impact Analysis

An attacker could access sensitive files, modify critical system files, or upload malicious files to the repository. This could lead to data breaches, system compromise, or unauthorized changes to the platform's functionality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security and privacy rules. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Apply the latest security patches from Arista Networks immediately. Restrict user permissions to the minimum required for their roles. Monitor file access and upload activities in the Network Provisioning Image Repository for suspicious behavior.

Hi! I’m here to help you understand CVE-2026-101154. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70