HPE Aruba Networking AOS-CX fixes 5 vulnerabilities, 1 of them critical

Do you think this report is well-written? *

Yes

Do you use this technology? *

Yes

Was this report useful to you?

Yes

We would be happy if you would describe:

The security services provided by CESNET are designed to provide significant support in ensuring the cybersecurity of connected organizations. Although we strive to provide quality and reliable services, it is not possible to guarantee absolute coverage of all security vulnerabilities. Our services should be seen as a complement to an organization's own security management, not as a replacement. The client bears ultimate responsibility for securing their environment.

This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] HPE Aruba Networking AOS-CX fixes 5 vulnerabilities, 1 of them critical

HPE Aruba fixes 5 vulnerabilities in HPE Aruba Networking AOS-CX with versions 10.17.1001, 10.16.1030, 10.13.1161 and 10.10.1180. The most severe ones are described below, the others can be found at [1].

HPE Aruba Networking AOS-CX - authentication bypass (CVE-2026-23813)

CVSS 9.8 (Critical)

An unauthenticated remote attacker can bypass authentication in the web management interface and gain administrator access to the device [1].

The vulnerability is present in product:

AOS-CX; >=10.17.0, <10.17.1001; >=10.16.0, <10.16.1030; >=10.13.0, <10.13.1161; >=10.10.0, <10.10.1180

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-23813 at cve.org, NVD
CWE-287: Improper Authentication at cwe.mitre.org

The vulnerability was publicly disclosed 10. 3. 2026.

HPE Aruba Networking AOS-CX - command injection (CVE-2026-23814)

CVSS 8.8 (High)

An authenticated remote attacker can exploit insufficient parameter validation in the command line interface (CLI) and execute arbitrary commands in the device's operating system [1].

The vulnerability is present in product:

AOS-CX; >=10.17.0, <10.17.1001; >=10.16.0, <10.16.1030; >=10.13.0, <10.13.1161; >=10.10.0, <10.10.1180

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-23814 at cve.org, NVD
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 3. 2026.

HPE Aruba Networking AOS-CX - command injection (CVE-2026-23815)

CVSS 7.2 (High)

An authenticated remote attacker can execute commands at the level of the device's operating system via a specific CLI binary component [1].

The vulnerability is present in product:

AOS-CX; >=10.17.0, <10.17.1001; >=10.16.0, <10.16.1030; >=10.13.0, <10.13.1161; >=10.10.0, <10.10.1180

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

CVE-2026-23815 at cve.org, NVD
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 10. 3. 2026.

Report feedback

[TLP:CLEAR] HPE Aruba Networking AOS-CX fixes 5 vulnerabilities, 1 of them critical

HPE Aruba Networking AOS-CX - authentication bypass (CVE-2026-23813)

CVSS 9.8 (Critical)

HPE Aruba Networking AOS-CX - command injection (CVE-2026-23814)

CVSS 8.8 (High)

HPE Aruba Networking AOS-CX - command injection (CVE-2026-23815)

CVSS 7.2 (High)

Links