An authenticated network user can exploit inadequate input validation on CloudVision CUE API endpoints, leading to SQL injection that can compromise the integrity of database queries and, in worst cases, disrupt the backend service, resulting in a denial of service. The flaw is aligned with CWE-74, which focuses on incorrect validation of user-supplied SQL fragments.

Arista Networks CloudVision CUE is affected. All releases prior to 2026.2.1 lack the fix. Users running earlier versions should assume the vulnerability exists.

The CVSS score of 7.1 reflects a moderate risk, but the lack of an EPSS score does not indicate low exploitation potential. Attackers need valid credentials to reach the API; thus, the threat is internal. Because the impact is service unavailability, organizations should treat this as a high priority in environments where network management operations rely on uninterrupted access. The vulnerability is not presently listed in CISA KEV, but the nature of the flaw warrants immediate remediation.