All vulnerabilities
CVE-2026-101152

CloudVision Portal: Security Advisory 0187

Arista Networks CloudVision Portal
Open in ThreatlineRecord JSON
CVSS
8.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.38%Chance of exploitation activity in the next 30 days, higher than 30% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2025.3.0Fixed versionCVE List
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user, causes the identity provider (IdP) to deliver authentication material to an attacker-controlled URL instead of to CloudVision.

Text from CVE List

Affected versions 4

  • CloudVision Portalaffected: 2026.2.0CVE List
  • CloudVision Portalaffected: 2026.1.0 through 2026.1.2CVE List
  • CloudVision Portalaffected: 2025.3.0 through 2025.3.3CVE List
  • CloudVision Portalaffected: 2021.1.0 before 2025.3.0CVE List

References 1