An authenticated remote attacker with specific permissions can read or write files on the platform file system beyond the intended scope through specially crafted requests or file uploads to the Software Management Studio Software Repository. This allows the attacker to compromise the confidentiality, integrity, and possibly availability of system files, and is a classic path traversal flaw (CWE‑22). The CVSS score of 8.6 indicates a high severity vulnerability that could enable sensitive data exposure or modification.

Arista Networks CloudVision Portal is affected. The vulnerability exists in the following releases: 2026.2.1 and later in the 2026.2.x train, 2026.1.3 and later in the 2026.1.x train, and 2025.3.4 and later in the 2025.3.x train.

The CVSS score of 8.6 signals a high impact if exploited. No EPSS score is available, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA KEV. The attack vector is likely an authenticated remote attacker with privileged permissions, meaning that users who can access the Software Repository could target the system if their accounts are compromised or over‑privileged.