CVE-2026-102159 Security Advisory 0190
Unauthenticated attackers can access internal backend functions, exposing sensitive location data or disrupting services in Arista CloudVision CUE.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-102159?
CVE-2026-102159 is a critical missing authorization vulnerability in Arista Networks CloudVision CUE, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.
Weakness: CWE-306
Which versions are affected by CVE-2026-102159?
How do I fix CVE-2026-102159?
No fix has been published for CVE-2026-102159 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-102159 being exploited?
There is no known exploitation of CVE-2026-102159 in the wild and no public exploit code.
Sources
Also known as GHSA-4pc8-pcf6-c2c3.