CVE-2026-101158CWE-79cross-site-scripting

CVE-2026-101158

High · published October 7, 2026

CVSS v3.1
8.4
EPSS
0%
Percentile
19.7
In the wild
Unconfirmed
What it is

A missing input validation vulnerability in the Fileserver upload API allows an authenticated attacker with file upload privileges to execute stored cross-site scripting (XSS). Successful exploitation could enable the attacker to hijack another CloudVision user's web session, potentially granting full access to their account and administrative permissions.

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00283 · 19.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-07T00:17Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24801-security-advisory-0185 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 19:36Z
    Security Advisory 0185
    cvelistv5