CVE-2026-101155
Security Advisory 0189
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 2025.3.0
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: none
- Automatable: no
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
An authenticated remote attacker with specific permissions can read or write files on the platform filesystem beyond the intended scope through specially crafted requests and/or crafted file uploads to the Software Management Studio Software Repository.
Affected versions
- Arista Networks CloudVision Portal
From 2026.1.0 · through 2026.1.2; From 2025.3.0 · through 2025.3.3; From 2024.2.0 · fixed in 2025.3.0