Which versions of Arista NGFW are affected by CVE-2026-25622?

Arista Edge Threat Management NGFW Captive Portal Custom Handler contains a command injection vulnerability allowing authenticated administrators to execute arbitrary shell commands on firewall…

How to fix or mitigate CVE-2026-25622?

Within 24 hours: Audit all systems running Arista NGFW with Captive Portal Custom Handler; enforce multi-factor authentication for management UI access and restrict admin role assignments to essential personnel only. Within 7 days: Enable comprehensive audit logging of all management UI administrative actions; deploy monitoring to detect suspicious command execution patterns on firewall systems. Within 30 days: Contact Arista for patch timeline and commit to immediate deployment upon release; evaluate temporary mitigation through network isolation of Captive Portal Custom Handler if patch remains unavailable beyond 30 days.

Arista NGFW CVE-2026-25622

Q: What is the CVSS score of CVE-2026-25622?

CVE-2026-25622 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-34907 HIGH

OS Command Injection (CWE-78)

2026-06-05 psirt@arista.com

GHSA-4vmg-9v32-fh3f

Command Injection Ng Firewall

7.0

CVSS 4.0 · Vendor: arista

Severity by source

Vendor (arista) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (arista) · only source for this CVE.

CVSS VectorVendor: arista

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 05, 2026 - 20:34 vuln.today

DescriptionCVE.org

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

AnalysisAI

Command injection in Arista Edge Threat Management Next Generation Firewall (NGFW) Captive Portal Custom Handler allows administrators authenticated to the management UI to execute arbitrary shell commands on the underlying platform. The CVSS 4.0 score of 7.0 reflects high privilege requirements (PR:H) offset by network reach and high confidentiality impact, with no public exploit identified at time of analysis.

Technical ContextAI

The flaw resides in the Captive Portal Custom Handler component of Arista's NGFW, part of the Edge Threat Management product line (formerly Untangle). Captive portals typically allow administrators to define custom hooks or scripts to process authentication events, and CWE-78 (OS Command Injection) indicates that user-supplied data is passed to a shell interpreter without sufficient neutralization of metacharacters. Because the handler runs at the OS layer of the firewall appliance, injected commands inherit the privileges of the captive portal service process on the platform shell.

RemediationAI

Apply the fixed release identified in Arista security advisory 0133 (https://www.arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133); the supplied data does not include an exact fix version, so consult the advisory for the patched build number. As compensating controls until patching, restrict NGFW administrative UI access to a dedicated management VLAN or jump host (reduces remote reachability but does not eliminate insider risk), enforce strong unique credentials and MFA for all admin accounts, and audit or temporarily disable the Captive Portal Custom Handler feature if it is not in active use (side effect: any custom captive portal post-auth scripting will stop functioning). Review captive portal handler configurations and audit logs for unexpected shell metacharacters.