Arista NGFW CVE-2026-25621

Exploitation requires (1) network reachability to the NGFW management interface where the Reports application is served, (2) high-privileged authenticated access - the CVSS vector PR:H confirms the attacker must already hold administrative credentials on the appliance, not a standard user account, (3) the target appliance must be running exactly Arista NGFW version 17.4.0, as the vendor confirms earlier releases are not affected, and (4) the attacker must reach the specific Reports application endpoint that processes the unvalidated input. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the PR:H requirement is the dominant limiting factor that confines realistic exploitation to insider threats, compromised admin credentials, or chained post-auth attacks.

Signals are mixed. CVSS 4.0 7.0 (High) with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/S:P indicates network-reachable, low-complexity exploitation but requires high privileges (PR:H), meaning the attacker must already hold an administrative role on the firewall - substantially limiting external risk. The Scope-changed (S:P, subsequent system impact present) signal is notable: a compromised Reports component could pivot to affect other systems the firewall touches. EPSS, KEV, and POC data were not provided, but no KEV listing and no referenced exploit code suggest this is not a mass-exploitation target today. The single vendor advisory reference and lack of NVD CPE enumeration mean exact build identifiers beyond '17.4.0' cannot be cross-verified from the supplied data. Realistic priority: medium for organizations running NGFW 17.4.0, primarily as a post-auth lateral movement / privilege-leveraging concern (e.g., a lower-privileged admin or compromised admin credential being escalated to OS command execution on a perimeter device).

An attacker who has obtained administrative credentials to the NGFW (via phishing, credential reuse, or insider access) authenticates to the management interface and submits a crafted parameter to the Reports application containing shell metacharacters; the unsanitized input is interpolated into a shell command, yielding arbitrary OS command execution as the reporting process user on the firewall. From there the attacker can read sensitive traffic-inspection data, modify firewall configuration, or pivot into the protected network segments the appliance fronts. No public exploit identified at time of analysis.