An OS command injection flaw in CloudVision CUE backup management allows an authenticated Super User to craft a backup request that passes arbitrary shell commands to the underlying operating system. This vulnerability can have the attacker execute any command as the CloudVision CUE service user, potentially compromising confidentiality, integrity, or availability of the system. The weakness corresponds to CWE‑78.

Arista Networks CloudVision CUE devices running firmware prior to release 2026.2.1. All earlier releases expose backup management without proper input sanitization.

The CVSS score for this issue is 8.6, classifying it as High severity. The EPSS score of 1% suggests the likelihood of exploitation is low but not negligible, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. The attack requires authentication as a Super User and access to the backup management interface, but once those prerequisites are satisfied, an attacker can execute arbitrary commands on the host with the service's privileges. The lack of a workaround forces rapid deployment of the vendor‑provided patch.