CVE-2026-25624

Medium

Description

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.

SeverityMedium

CVSS5.7

Exploit probability—

Product

Arista Ng Firewall

PublishedJun 5, 2026

First seenJun 5, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

arista ng_firewall17.4.1 or later

Vendor advisories

arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133

Affected products

Product	Affected versions	Fixed in
arista ng_firewall	v < 17.4.1	17.4.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.