Cyber Resilience

CVE-2026-25621

RCE in Arista Ng Firewall 17.4

RCECommand Injection
Published
05 June 2026
Modified
17 June 2026
Patch / advisory
View advisory
CVSS Score v4 7.0
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0022 13th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-25621 is a high-severity OS Command Injection (CWE-78) vulnerability in Arista Ng Firewall. Its CVSS base score is 7.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-6 (Least Privilege) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

A Reports application infrastructure vulnerability exists in Arista Edge Threat Management - Arista Next Generation Firewall (NGFW) due to insecure input validation. This issue uniquely affects version 17.4.0; earlier software releases are not exposed.

CWE(s)
CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

CWE-78 OS command injection in public-facing NGFW Reports app directly enables T1190 exploitation and arbitrary command execution via T1059.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-25620Same product: Arista Ng Firewall
CVE-2026-25623Same product: Arista Ng Firewall
CVE-2024-9132Same product: Arista Ng Firewall
CVE-2024-12829Same product: Arista Ng Firewall
CVE-2026-25622Same product: Arista Ng Firewall
CVE-2024-9134Same product: Arista Ng Firewall
CVE-2024-9188Same product: Arista Ng Firewall
CVE-2024-47520Same product: Arista Ng Firewall
CVE-2024-27889Same product: Arista Ng Firewall
CVE-2024-12830Same product: Arista Ng Firewall

Affected Assets

arista
ng firewall
17.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • AC-6 Least Privilege
  • SI-2 Flaw Remediation
Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.2.5
  • V1.2.8
  • V15.2.5

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly enforces validation of all inputs to the Reports application, blocking the special characters that enable CWE-78 OS command injection.

AC-6 Least Privilege partial match
prevent

Ensures the Reports process and any invoked commands execute with only the privileges required, limiting the impact of a successful command injection in v17.4.0.

SI-2 Flaw Remediation partial match
prevent

Requires prompt application of vendor patches that remediate the insecure input handling present only in NGFW version 17.4.0.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

PR.PS-06's SDLC practices directly require secure coding and input handling that blocks command-injection defects, yet the single broad outcome leaves many specific neutralization vectors and verification gaps unaddressed.

PR.PS-02 partial match
prevents

Routine patching/maintenance can remediate known command-injection CVEs in dependencies (partial forward) but does nothing to stop developers from introducing improper neutralization in custom code (none reverse).

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing and code review target insecure use of operating-system command interfaces, catching command-injection flaws introduced during development.

References