Arista CloudVision: path traversal lets a high-privilege user read unintended files from the Sensor

Impact

A path traversal in on-premises CloudVision Portal and CloudVision Sensor lets an already highly privileged authenticated user pull files the Sensor was not meant to expose. On a fabric management appliance that can mean credentials, certificates or device inventory covering the switches in front of the GPU fleet, which is why Arista rates the scope change high. The privilege bar is high and the complexity is high, so this is a privilege-escalation and secrets-exposure problem inside the management plane rather than an entry point from outside it. Treat it as a reason to rotate anything the Sensor holds if you suspect misuse, not as an emergency fabric outage risk.

Who can reach it

Authenticated user with high privileges on CloudVision Portal (on-premises) or the CloudVision Sensor, reachable from the management VLAN. Authentication and elevated rights are both required.

What to do

Upgrade CloudVision Portal / Sensor to a fixed release per Arista security advisory 0188. This is a management-plane service upgrade and restart, not a switch reload; data-plane forwarding is unaffected but telemetry collection pauses during the restart. Keep high-privilege CloudVision accounts to a minimum and audit who holds them. Arista's advisory is the authority on fixed versions.

References

Related entries

• Perle IOLAN STS/SCS terminal server (firmware before 6.0): A logged-in user of the restricted admin shell (TelnetCVE-2026-23759 · Perle IOLAN STS/SCS terminal server (firmware before 6.0)High
• Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boards: Crafted characters injectedCVE-2026-3820 · Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boardsHigh
• Dell OMSA: high-privileged remote user escalates beyond their assigned OMSA roleCVE-2026-81445 · Dell OpenManage Server Administrator (privilege management, admin-level)High
• Dell OMSA: remote heap overflow gives code execution to a high-privileged accountCVE-2026-81477 · Dell OpenManage Server Administrator (remote heap-based buffer overflow)High
• Dell OMSA: remote stack overflow gives code execution to a high-privileged accountCVE-2026-81480 · Dell OpenManage Server Administrator (stack-based buffer overflow)High
• Intel CSME / Converged Security and Management Engine (mask ROM): A flaw in the CSME boot ROM window before memoryCVE-2019-0090 · Intel CSME / Converged Security and Management Engine (mask ROM)High