A stored cross‑site scripting flaw in Arista Networks CloudVision CUE allows an authenticated, high‑privilege administrator to inject malicious JavaScript into configuration data. When a different authenticated user renders or compares that configuration, the injected code executes in their browser, supplying the attacker with the ability to run arbitrary scripts, steal session tokens, read or modify configuration, and disrupt wireless services. This is a classic stored XSS (CWE‑79) that can turn a privileged user session into a vector for further exploitation.

The vulnerability affects Arista Networks CloudVision CUE products running versions prior to 2026.2.1. Users of earlier releases are potentially vulnerable until they upgrade to 2026.2.1 or later, which contains the fix.

The CVSS score of 6.2 classifies the flaw as moderate severity, and the EPSS score is currently not available, while it is not listed in the CISA KEV catalog. Successful exploitation requires that an attacker first obtain a high‑privilege administrator account in order to embed the payload; the attack then succeeds when another authenticated user views or compares the compromised configuration. Because exploitation can occur only within the organization and no publicly available exploits are reported, the risk in the wild may be limited, but the impact of a successful compromise—using the victim’s browser session to act arbitrarily and access sensitive data—can be significant.