CVE-2026-25624

MEDIUM 4.8CVE-2026-25624 · Published 05/06/2026 · updated 23/07/2026

In short

CVE-2026-25624 is a MEDIUM (CVSS 4.8) vulnerability affecting ng firewall (arista).
Chance of exploitation in the next 30 days (EPSS): 0.15%, higher than 4.5% of all vulnerabilities.
Fix: update to 17.4.1 or later.

Package	Affected versions	Patched versions
ng firewall arista	`< 17.4.1`	`17.4.1`

Description

An administrative cross-site scripting (XSS) vulnerability exists in the web user interface dashboard layout of Arista Edge Threat Management - Arista Next Generation Firewall (NGFW). Unvalidated user-supplied variables are echoed back to administrative profiles, facilitating vector payload processing behavior controls.

References

arista.com/en/support/advisories-notices/security-advisory/23399-security-advisory-0133 · Vendor Advisory

More vulnerabilities in ng firewall

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

ng firewall

arista

< 17.4.1

17.4.1

Description

More vulnerabilities in ng firewall

See all →