An access‑control flaw exists in the CV-CUE backend that allows an unauthenticated network attacker to exercise functionality reserved for internal services. The vulnerability may expose sensitive location data or disrupt the functionality of the affected services. The flaw is categorized as CWE‑306, indicating improper control over exposed features.

Arista Networks CloudVision CUE. Versions prior to 2026.2.1 are affected; the fix is implemented in release 2026.2.1 and later.

With a CVSS score of 9.3 the vulnerability is considered critical. EPSS data is not available, and KEV has not listed this issue, but the high severity indicates a significant risk of exploitation. The attacker’s ability to exploit the flaw requires only network access and no authentication, making the attack vector likely to be a remote network attack from external or untrusted networks. Successful exploitation would allow the attacker to read protected internal data or disrupt services.