{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-101153",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T19:49:23.342532Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T19:49:31.675Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "CloudVision Portal, virtual appliance or physical appliance"
          ],
          "product": "CloudVision Portal",
          "vendor": "Arista Networks",
          "versions": [
            {
              "status": "affected",
              "version": "2026.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2026.1.2",
              "status": "affected",
              "version": "2026.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2025.3.3",
              "status": "affected",
              "version": "2025.3.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2025.2.3",
              "status": "affected",
              "version": "2025.2.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2025.1.4",
              "status": "affected",
              "version": "2025.1.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "2024.3.3",
              "status": "affected",
              "version": "2024.3.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "CloudVision Sensor"
          ],
          "product": "CloudVision Sensor",
          "vendor": "Arista Networks",
          "versions": [
            {
              "lessThanOrEqual": "1.4.2",
              "status": "affected",
              "version": "1.4.0",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "1.3.1",
              "status": "affected",
              "version": "1.3.0",
              "versionType": "custom"
            },
            {
              "lessThan": "1.3.0",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e"
            }
          ],
          "value": "No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eOn affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.\u003c/p\u003e"
            }
          ],
          "value": "On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-126",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-126 Path Traversal"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T19:38:07.896Z",
        "orgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
        "shortName": "Arista"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24804-security-advisory-0188"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eCVE-2026-101153 has been fixed in the following releases:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Portal:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Sensor:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e1.4.3 and later releases in the 1.4.x train\u003c/li\u003e\u003c/ul\u003e"
            }
          ],
          "value": "CVE-2026-101153 has been fixed in the following releases:\n\nCloudVision Portal:\n- 2026.2.1 and later releases in the 2026.2.x train\n- 2026.1.3 and later releases in the 2026.1.x train\n\nCloudVision Sensor:\n- 1.4.3 and later releases in the 1.4.x train"
        }
      ],
      "source": {
        "advisory": "Security Advisory 0188",
        "defects": [
          "BUG 1898011"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Security Advisory 0188",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThere is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\u003c/p\u003e\u003cpre\u003e# Stop sensor completely:\ncvpi stop sensor\u003c/pre\u003e\u003cp\u003eTo undo this and to start the sensor again use:\u003c/p\u003e\u003cpre\u003e# Start sensor:\ncvpi start sensor\u003c/pre\u003e"
            }
          ],
          "value": "There is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\n\n# Stop sensor completely:\ncvpi stop sensor\n\nTo undo this and to start the sensor again use:\n\n# Start sensor:\ncvpi start sensor"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7",
    "assignerShortName": "Arista",
    "cveId": "CVE-2026-101153",
    "datePublished": "2026-10-06T19:38:07.896Z",
    "dateReserved": "2026-09-28T08:30:31.034Z",
    "dateUpdated": "2026-10-06T19:49:31.675Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"shortName\": \"Arista\", \"dateUpdated\": \"2026-10-06T19:38:07.896Z\"}, \"title\": \"Security Advisory 0188\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eOn affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.\u003c/p\u003e\"}]}], \"affected\": [{\"vendor\": \"Arista Networks\", \"product\": \"CloudVision Portal\", \"platforms\": [\"CloudVision Portal, virtual appliance or physical appliance\"], \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"2026.2.0\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"2026.1.0\", \"lessThanOrEqual\": \"2026.1.2\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"2025.3.0\", \"lessThanOrEqual\": \"2025.3.3\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"2025.2.0\", \"lessThanOrEqual\": \"2025.2.3\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"2025.1.0\", \"lessThanOrEqual\": \"2025.1.4\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"2024.3.0\", \"lessThanOrEqual\": \"2024.3.3\", \"status\": \"affected\", \"versionType\": \"custom\"}]}, {\"vendor\": \"Arista Networks\", \"product\": \"CloudVision Sensor\", \"platforms\": [\"CloudVision Sensor\"], \"defaultStatus\": \"unaffected\", \"versions\": [{\"version\": \"1.4.0\", \"lessThanOrEqual\": \"1.4.2\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"1.3.0\", \"lessThanOrEqual\": \"1.3.1\", \"status\": \"affected\", \"versionType\": \"custom\"}, {\"version\": \"1.0.0\", \"lessThan\": \"1.3.0\", \"status\": \"affected\", \"versionType\": \"custom\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV3_1\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 8, \"baseSeverity\": \"HIGH\"}}, {\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H\", \"baseScore\": 7.2, \"baseSeverity\": \"HIGH\"}}], \"problemTypes\": [{\"descriptions\": [{\"type\": \"CWE\", \"cweId\": \"CWE-22\", \"lang\": \"en\", \"description\": \"CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\"}]}], \"impacts\": [{\"capecId\": \"CAPEC-126\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-126 Path Traversal\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"No specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eNo specific configuration is required to be vulnerable to this issue. This vulnerability is present in the default configuration of affected releases.\u003c/p\u003e\"}]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"There is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\\n\\n# Stop sensor completely:\\ncvpi stop sensor\\n\\nTo undo this and to start the sensor again use:\\n\\n# Start sensor:\\ncvpi start sensor\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eThere is no reliable mitigation other than stopping the sensor component completely, which would prevent all functionality dependent on it from working. To stop the sensor, execute the following command on the CloudVision or Sensor VM:\u003c/p\u003e\u003cpre\u003e# Stop sensor completely:\\ncvpi stop sensor\u003c/pre\u003e\u003cp\u003eTo undo this and to start the sensor again use:\u003c/p\u003e\u003cpre\u003e# Start sensor:\\ncvpi start sensor\u003c/pre\u003e\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"CVE-2026-101153 has been fixed in the following releases:\\n\\nCloudVision Portal:\\n- 2026.2.1 and later releases in the 2026.2.x train\\n- 2026.1.3 and later releases in the 2026.1.x train\\n\\nCloudVision Sensor:\\n- 1.4.3 and later releases in the 1.4.x train\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eCVE-2026-101153 has been fixed in the following releases:\u003c/p\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Portal:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e2026.2.1 and later releases in the 2026.2.x train\u003c/li\u003e\u003cli\u003e2026.1.3 and later releases in the 2026.1.x train\u003c/li\u003e\u003c/ul\u003e\u003cp\u003e\u003cstrong\u003eCloudVision Sensor:\u003c/strong\u003e\u003c/p\u003e\u003cul\u003e\u003cli\u003e1.4.3 and later releases in the 1.4.x train\u003c/li\u003e\u003c/ul\u003e\"}]}], \"references\": [{\"url\": \"https://www.arista.com/en/support/advisories-notices/security-advisory/24804-security-advisory-0188\", \"tags\": [\"vendor-advisory\"]}], \"source\": {\"advisory\": \"Security Advisory 0188\", \"discovery\": \"INTERNAL\", \"defects\": [\"BUG 1898011\"]}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-101153\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-10-06T19:49:23.342532Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-10-06T19:49:28.163Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-101153\", \"assignerOrgId\": \"c8b34d1a-69ae-45c3-88fe-f3b3d44f39b7\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Arista\", \"dateReserved\": \"2026-09-28T08:30:31.034Z\", \"datePublished\": \"2026-10-06T19:38:07.896Z\", \"dateUpdated\": \"2026-10-06T19:49:31.675Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}