CVE-2026-25622: Arista NG Firewall RCE Vulnerability

CVE-2026-25622 Overview

CVE-2026-25622 is a command injection vulnerability [CWE-78] in the Captive Portal Custom Handler of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). An authenticated administrator using the management user interface can supply crafted input that the handler passes to the underlying shell. The handler executes arbitrary platform shell commands as a result.

Arista published Security Advisory #0133 to address the issue. The vulnerability requires high privileges and network access to the administrative interface. No public exploit code or in-the-wild exploitation has been reported.

Critical Impact
An authenticated administrator can execute arbitrary OS commands on the firewall platform, leading to full compromise of the NGFW host and pivoting opportunities into the protected network.

Affected Products

Arista Edge Threat Management - Arista Next Generation Firewall (NGFW)
arista:ng_firewall (all versions prior to the Security Advisory #0133 fix)
Captive Portal Custom Handler component

Discovery Timeline

2026-06-05 - CVE-2026-25622 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-25622

Vulnerability Analysis

The vulnerability resides in the Captive Portal Custom Handler feature of Arista NGFW. Captive portal handlers let administrators define custom logic that runs when unauthenticated users hit the portal. The handler accepts administrator-supplied input and forwards it to a shell interpreter without adequate sanitization.

An administrator authenticated to the NGFW web UI can inject shell metacharacters into the custom handler configuration. When the handler is invoked, the firewall executes those injected commands under the service account that runs the captive portal subsystem. This typically corresponds to a privileged platform context on the firewall appliance.

The flaw is classified as OS Command Injection under [CWE-78]. The attack vector is network-based against the administrative interface, and exploitation requires successful authentication as an administrator.

Root Cause

The root cause is improper neutralization of special elements used in an OS command. The custom handler logic concatenates administrator input into a command string passed to a shell, rather than using parameterized process invocation or strict allowlist validation of inputs.

Attack Vector

Exploitation requires an authenticated session in the NGFW administrative UI. The attacker navigates to the Captive Portal Custom Handler configuration and submits a payload that contains shell metacharacters such as ;, |, $(), or backticks. When the handler runs, the injected commands execute on the firewall operating system.

Because the precondition is administrative access, the most realistic abuse scenarios involve a malicious insider, a compromised administrator credential, or a chained attack that first achieves admin access through phishing or session theft. Refer to the Arista Security Advisory #0133 for technical specifics.

Detection Methods for CVE-2026-25622

Indicators of Compromise

Unexpected child processes spawned by captive portal or web UI service accounts on the NGFW host, particularly shells such as /bin/sh or /bin/bash invoking system utilities.
Audit log entries showing modifications to Captive Portal Custom Handler configuration outside of approved change windows.
Outbound network connections initiated by the firewall management plane to unfamiliar external IP addresses.
New or modified files in writable system directories on the appliance, including cron entries or SSH authorized_keys.

Detection Strategies

Monitor administrative UI audit trails for changes to captive portal handler definitions and correlate with the authenticated user identity.
Alert on shell command patterns such as command separators (;, &&, |) and command substitution syntax ($(), backticks) appearing in handler configuration fields.
Compare running configuration against a known-good baseline and flag any drift in captive portal handler logic.

Monitoring Recommendations

Forward NGFW administrative and system logs to a centralized SIEM and retain them for incident review.
Track authentication events to the administrative interface and alert on logins from unusual source IP ranges or outside business hours.
Monitor process execution telemetry on the firewall appliance, if available, for shell invocations originating from web service processes.

How to Mitigate CVE-2026-25622

Immediate Actions Required

Apply the fixed release identified in Arista Security Advisory #0133 on all affected NGFW deployments.
Restrict access to the NGFW administrative interface to a dedicated management network or jump host.
Audit administrator accounts and rotate credentials for any account that may have been compromised.
Review captive portal handler configurations for unexpected shell metacharacters or unfamiliar logic.

Patch Information

Arista has released a fix in the version referenced by Arista Security Advisory #0133. Administrators should consult the advisory for the exact fixed build numbers and upgrade procedure for their deployment.

Workarounds

Disable the Captive Portal Custom Handler feature if it is not required by the deployment.
Enforce multi-factor authentication on all administrative accounts to reduce the risk of credential compromise leading to exploitation.
Apply role-based access control so that only a minimal set of administrators can modify captive portal configuration.
Place the NGFW management interface behind a VPN or bastion host to limit network exposure.

bash

# Configuration example
# Restrict management interface access at the network layer
# (illustrative iptables rules applied upstream of the NGFW)
iptables -A INPUT -p tcp -s 10.10.0.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP