The vulnerability is a stored cross‑site scripting flaw that allows an unauthenticated attacker with adjacent‑network access to inject malicious code which is then executed when an authenticated user views the affected content. This can compromise the victim’s browser session, enable access to sensitive data, change system state, or disrupt services. The weakness corresponds to CWE‑79, a classic input validation failure that permits script execution in the user’s context.

Products affected are Arista Networks CloudVision CUE. Any release prior to 2026.2.1 contains the flaw; the problem was remediated in 2026.2.1 and later versions.

The CVSS score of 9.3 indicates a high severity. No EPSS data is available, so the current exploitation probability cannot be quantified precisely, but the lack of a KEV listing suggests no widely known public exploits yet. The attack path is an unauthenticated network injector that places script payloads into stored content; an authenticated user’s browser then runs the injected code, potentially hijacking the session or manipulating the interface.