CVE-2026-25622CWE-78

Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection

High · published June 5, 2026

CVSS v4.0
7.0
EPSS
1%
Percentile
61.7
In the wild
Unconfirmed
What it is

A Captive Portal Custom Handler command injection vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). On affected platforms, an administrative account logged into the user interface can exploit this input handling behavior to execute arbitrary platform shell commands.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/S:P
EPSS
0.00975 · 61.7th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-06-05T19:29Z
EPSS history
Timeline
  • 05 JUN 19:29Z
    Arista Edge Threat Management NGFW Captive Portal Custom Handler Command Injection
    cvelistv5