CVE-2026-102158

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Arista Networks, Inc.

Description

Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102158

EUVD

EUVD-2026-93955

Affected Vendors & Products

Vendor	Product	Version / Range
Arista	Networks	CloudVision CUE 2022.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-74	The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of API request parameters in Arista Networks CloudVision CUE. An authenticated network user could exploit this to perform SQL injection against the backend, potentially impacting its availability.

Detection Guidance

Detection requires monitoring for unusual SQL query patterns or errors in CloudVision CUE API logs. Check for excessive database connection attempts or malformed queries. Use network traffic analysis tools like tcpdump or Wireshark to inspect API requests for suspicious parameters. Enable detailed logging in CloudVision CUE and review logs for SQL syntax errors or unexpected database responses.

Impact Analysis

An attacker could exploit this to disrupt backend services, leading to downtime or reduced performance. This may affect operations relying on CloudVision CUE for network management or automation.

Compliance Impact

This vulnerability allows SQL injection via improperly validated API parameters, which could lead to unauthorized data access or manipulation. For GDPR, this may result in data breaches violating confidentiality and integrity requirements. For HIPAA, it could compromise protected health information integrity and availability.

Mitigation Strategies

Immediately update CloudVision CUE to the latest patched version. Restrict API access to trusted networks or users via firewall rules. Implement input validation for all API parameters to block SQL injection attempts. Monitor database performance and logs for signs of exploitation. Consider disabling the affected API endpoints if not critical until patched.

Hi! I’m here to help you understand CVE-2026-102158. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70