CVE-2026-102159CWE-306

CVE-2026-102159

Critical · published October 7, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

An access-control flaw in the CV-CUE backend may allow an unauthenticated network attacker to access functionality intended only for internal services. Successful exploitation may expose sensitive location information or disrupt affected services.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00363 · 29.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-10-07T00:17Z
References (1)
https://www.arista.com/en/support/advisories-notices/security-advisory/24806-security-advisory-0190 · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 19:39Z
    Security Advisory 0190
    cvelistv5