CVE-2026-25622: Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

Severity: medium (CVSS 6.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-05 · updated 2026-07-23
Weakness: CWE-78

Description

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

Affected products

Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW): before 17.4.1 — fixed in 17.4.1

How to fix

Upgrade to a fixed version: Arista Networks Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) 17.4.1. Check the vendor advisory for mitigations.

References

https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133

Get alerted when CVE-2026-25622 or the next vulnerability affects your stack