The vulnerability is an XML External Entity (XXE) injection flaw in the WiFi-server Spectralight application of Arista Networks CloudVision CUE. An authenticated user can send a crafted XML request that causes the server to resolve external entities, allowing the attacker to read arbitrary local files. The flaw also enables a partial denial of service by consuming server resources, potentially destabilizing the application.

Arista Networks CloudVision CUE is affected. The issue exists in all versions prior to 2026.2.1, a fix being released in 2026.2.1 and all newer updates.

The CVSS score of 7.1 denotes a high impact, while the EPSS score is not available and the flaw is not listed in CISA KEV. Exploitation requires valid authentication to the CloudVision CUE system. Once authenticated, an attacker can submit malicious XML to the Spectralight endpoint to read local files and potentially disrupt service, making the risk medium to high for environments with broad or compromised privileged accounts.