An unauthenticated attacker located on an adjacent private network has the ability to forge the source IP address of packets that reach the CV-CUE backend. By doing so, the attacker can create an administrative session and gain full privileged access to the system. The flaw involves improper authentication controls (CWE-290) and the handling of source IP addresses, enabling an attacker to bypass normal access restrictions.

The vulnerability affects Arista Networks CloudVision CUE deployments running any version older than 2026.2.1. The advisory specifies that all releases preceding this update are susceptible to the issue; upgrading to version 2026.2.1 or later applies the corrective changes.

The CVSS score of 8.7 indicates a high severity. Although an EPSS score is not available, the lack of a publicly known exploit and absence from the CISA KEV catalog reduce the likelihood of widespread exploitation. Nonetheless, an attacker with access to the adjacent network can leverage the IP spoofing capability to elevate privileges. The attack vector is local network access, requiring only that traffic be able to reach the CV-CUE backend. Because no workaround is offered, timely patching and network segmentation are the primary defenses.