CVE-2026-25622 MEDIUM

CVE-2026-25622: Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

Vendor Arista Networks
Product Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
Weakness CWE-78
Published June 5, 2026
Last update June 5, 2026
View on NVD All CVEs

CVSS base score

6.0/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L

What the vulnerability does

01Description

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

Key dates

02Disclosure timeline

June 5, 2026 CVE published
June 5, 2026 Record updated