Which versions of Arista NGFW are affected by CVE-2026-25621?

Arista Edge Threat Management NGFW version 17.4.0 contains a command injection vulnerability in the Reports application that allows high-privileged administrators to execute arbitrary OS commands on…

How to fix or mitigate CVE-2026-25621?

Within 24 hours: Inventory and classify all Arista NGFW deployments running version 17.4.0 by operational criticality. Within 7 days: Evaluate feasibility of downgrading affected appliances to version 16.x or earlier (confirmed unaffected), or implement access restrictions if downgrade is not viable; disable Reports application if operationally acceptable. Within 30 days: Engage Arista support to establish patch timeline; develop and stage a patching plan for deployment upon release.

Arista NGFW CVE-2026-25621

Q: What is the CVSS score of CVE-2026-25621?

CVE-2026-25621 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-34905 HIGH

OS Command Injection (CWE-78)

2026-06-05 psirt@arista.com

GHSA-36wx-6wfq-226v

Command Injection Ng Firewall

7.0

CVSS 4.0 · Vendor: arista

Severity by source

Vendor (arista) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (arista) · only source for this CVE.

CVSS VectorVendor: arista

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:35 vuln.today

DescriptionCVE.org

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

AnalysisAI

Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) version 17.4.0 allows high-privileged authenticated attackers to abuse insecure input validation in the Reports application to execute OS commands on the appliance. The flaw uniquely affects 17.4.0, with earlier releases unaffected, and no public exploit identified at time of analysis. CVSS 4.0 base score is 7.0 with confidentiality high and integrity/availability low, reflecting a scope-changing impact constrained by the high privileges required.

Technical ContextAI

The vulnerability is rooted in CWE-78 (OS Command Injection) within the Reports application infrastructure of Arista's Edge Threat Management (ETM) NGFW platform, which derives from the Untangle/Arista NG Firewall lineage providing UTM-style perimeter security, web filtering, and reporting. CWE-78 typically arises when user-controllable input is concatenated into shell commands executed by system() / exec() style calls without proper neutralization of metacharacters such as ;, |, &, $(), or backticks. The 'insecure input validation' wording in the advisory, combined with the Reports component being the affected surface, suggests a parameter passed to a reporting subsystem (likely report generation, filtering, or export) is reaching an underlying shell invocation on the firewall's Linux base OS.

RemediationAI

Patch status is not explicitly stated in the supplied data - no vendor-released patch version is enumerated in the input, so consult the Arista advisory at https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133 for the fixed release and apply it to all NGFW appliances running 17.4.0. As compensating controls while patching is scheduled, restrict administrative access to the NGFW management interface to a dedicated jump host or management VLAN (since PR:H is required, tightening who can authenticate as a privileged admin directly reduces the exploitable population), enforce MFA on firewall admin accounts, and audit Reports application usage logs for unexpected parameters or shell metacharacters in report queries. If feasible without operational impact, disable or restrict access to the Reports application for non-essential admin roles - trade-off being loss of reporting visibility for those users until the patch is applied.