CVE-2026-25622 Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection
Administrative users can execute arbitrary shell commands via the Captive Portal Custom Handler in Arista NGFW.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25622?
CVE-2026-25622 is a high-severity command injection vulnerability in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW), published on 5 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.
Weakness: CWE-78
Which versions are affected by CVE-2026-25622?
It affects 1 product.
Products include Arista Ng Firewall.
How do I fix CVE-2026-25622?
No fix has been published for CVE-2026-25622 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-25622 being exploited?
There is no known exploitation of CVE-2026-25622 in the wild and no public exploit code.
Other vulnerabilities in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
- CVE-2025-2767 Arista NG Firewall User-Agent Cross-Site Scripting Remote Code Execution Vulnerability
- CVE-2024-9188 Specially constructed queries cause cross platform scripting leaking administrator tokens
- CVE-2024-27889 SQL injection in Arista Edge Threat Management - Arista NG Firewall (NGFW)
- CVE-2024-47519 Backup uploads to ETM subject to man-in-the-middle interception
- CVE-2024-9134 SQL injection in Arista Edge Threat Management
Sources
Also known as GHSA-4vmg-9v32-fh3f.