Improper neutralization of LDAP authentication input can allow an unauthenticated network attacker, under high‑complexity conditions, to inject arbitrary LDAP queries against the configured directory service. This flaw permits the attacker to send malicious LDAP requests that could potentially expose or manipulate directory data, compromising confidentiality and integrity of the directory contents. The vulnerability does not provide immediate local privilege escalation or denial of service, but it provides a vector for unintended data exposure or structural disruption within the directory service.

The issue appears in Arista Networks CloudVision CUE prior to version 2026.2.1. The affected system is the CloudVision CUE component that relies on LDAP authentication for user management and access control. Users of earlier releases who have not applied the available patch remain exposed.

The CVSS score of 6.9 classifies the vulnerability as moderate severity. The EPSS score is not available, so the current exploitation probability is unclear, and the vulnerability is not listed in CISA’s KEV catalog. The attacker must be able to reach the CloudVision CUE appliance over the network and is unauthenticated. Because the flaw requires high‑complexity conditions and involves the injection of LDAP queries, a successful exploit would likely require a well‑prepared attacker and may be harder to carry out than low‑complexity local vulnerabilities. Nevertheless, the potential impact on directory data and the possibility of bypassing authentication controls justify moderate risk.