CVE-2026-102159

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Arista Networks, Inc.

Description

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102159

EUVD

EUVD-2026-93956

Affected Vendors & Products

Vendor	Product	Version / Range
Arista	Networks	CloudVision CUE 2022.3.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability is an access-control flaw in the CV-CUE backend of Arista Networks CloudVision CUE. It allows an unauthenticated network attacker to access internal service functionality. Exploitation could expose sensitive location data or disrupt services.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized access to CV-CUE backend functionality. Monitor network traffic for unusual requests targeting internal services. Inspect logs for unauthenticated access attempts to sensitive endpoints. Use tools like tcpdump or Wireshark to capture and analyze traffic on ports associated with CV-CUE.

Impact Analysis

An attacker could access sensitive location information or cause service disruptions. The high CVSS scores (9.3 v4.0, 9.8 v3.1) indicate severe impact, including potential data breaches or operational interference.

Compliance Impact

Exposure of sensitive location data could violate GDPR (privacy) or HIPAA (health data). The high impact severity may lead to non-compliance, fines, or legal consequences depending on data processed.

Mitigation Strategies

Immediately restrict network access to the CV-CUE backend to trusted internal services only. Review and update access controls to ensure unauthenticated users cannot reach internal functionality. Monitor for unusual activity or unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-102159. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70