Aruba Products Multiple Vulnerabilities
Severity Level: Medium
Date: 11/03/2026
Ref: CERT-NCSOC-0238
System / Technologies Affected
- AOS-CX 10.17.xxxx: 10.17.0001 and below
- AOS-CX 10.16.xxxx: 10.16.1020 and below
- AOS-CX 10.13.xxxx: 10.13.1160 and below
- AOS-CX 10.10.xxxx: 10.10.1170 and below
Overview
HPE Aruba Networking has released AOS-CX software patches to address multiple security vulnerabilities.
Description
The identified vulnerabilities include:
- CVE-2026-23813 – A vulnerability in the web-based management interface of AOS-CX switches that could allow an unauthenticated remote actor to circumvent authentication controls and, in some cases, reset the admin password.
- CVE-2026-23814 – A vulnerability in the command parameters of a certain AOS-CX CLI command that could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behaviour.
- CVE-2026-23815 – A vulnerability in a custom binary used in AOS-CX switches’ CLI that could allow a high-privilege authenticated remote attacker to perform command injection and execute unauthorized commands.
- CVE-2026-23816 – A vulnerability in the command line interface of AOS-CX switches that could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.
- CVE-2026-23817 – A vulnerability in the web-based management interface of AOS-CX switches that could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.
Impact
- Remote Code Execution
- Security Restriction Bypass
Solution / Workarounds
Before installation of the software, please visit the vendor’s website for more details.
Apply fixes issued by the vendor:
Reference
Disclaimer
The information provided herein is on an "as is" basis, without warranty of any kind.
