Medium severity · published Jun 5, 2026
CVE-2026-25622
Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection
6.0
CVSS
9.9%
EPSS
No
On KEV
Description
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.9% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) · Arista Networks
through 17.4.0 · source: vendor
NF
NG Firewall · Arista
before 17.4.1 · source: NVD
Affected product
AE
Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
Arista Networks
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25622
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25622
Vendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133
More from Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
6.0
CVE-2026-25623
Arista Edge Threat Management NGFW UI Arbitrary Command Execution
6.0
CVE-2026-25621
Arista Edge Threat Management NGFW Reports Application Insecure Input Validation
6.0
CVE-2026-25620
Arista Edge Threat Management NGFW Captive Portal Encrypted Password Command Injection
4.8
CVE-2026-25624
Arista Edge Threat Management NGFW UI Administrative Cross-Site Scripting