Arista NGFW CVE-2026-25623

Exploitation requires a valid high-privilege administrator account on the Arista NGFW (CVSS PR:H) plus network reachability to the browser-based management interface, and the attacker must interact with the specific 'browser management pipeline' endpoint that fails to validate input before passing it to a shell/script interpreter. No user interaction by a second party is needed (UI:N). Exploitation is limited by the requirement for prior administrative authentication, by any network segmentation that restricts who can reach the management UI, and by the fact that the vulnerable code path lives in management functionality rather than data-plane traffic - ordinary firewalled traffic does not trigger it.

Risk is moderate rather than critical. CVSS 4.0 scores it 7.0 with AV:N/AC:L but PR:H, meaning a network-reachable bug that nevertheless requires administrative credentials - significantly limiting the population of attackers who can reach it. There is no CISA KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided. The subsequent system impact is meaningful (VC:H, with VI:L/VA:L and a Scope/Subsequent component indicating limited spillover) because shell access on a firewall appliance undermines the integrity of the perimeter device itself. Realistic threat actors are insiders, attackers who have already phished an admin, or supply-chain/managed-service compromise - not opportunistic mass scanners. Defenders should treat this as a privilege-escalation/post-auth hardening issue rather than a drop-everything emergency, while still patching promptly given the device class.

An attacker who has obtained or phished an NGFW administrator credential - or a malicious insider with admin rights - logs into the browser management console and submits a crafted request to the vulnerable management pipeline whose parameters include shell metacharacters. The injected command runs as the underlying management process, giving the attacker an interactive foothold on the firewall to disable filtering rules, exfiltrate configuration and traffic captures, or pivot deeper into the network. No public proof-of-concept has been identified at time of analysis.