CVE-2026-95717: Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

Published Oct 22, 2026

Updated

No description provided

Affected Software

1 affected component

HPE Arubaos

Event History

Oct 22, 2026

CVE Published

via MITRE·07:07 PM

Data Sourced

via MITRE·07:07 PM

DescriptionSeverity

Frequently Asked Questions

What level of access does an attacker need before exploitation is possible?

The attacker must already have high privileges in the affected environment. The CVSS vector indicates that no additional user interaction is required once those privileges are available.

Can this be exploited remotely?

Yes. The attack vector is network-based and has low attack complexity, so an attacker with the necessary privileges could target the web-based management interface over the network.

What is the expected security impact?

The reported impact is low confidentiality and low integrity impact, with no availability impact. The CVSS vector also indicates that the impact may extend beyond the initially vulnerable security authority.

CVE-2026-95717: Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need before exploitation is possible?

Can this be exploited remotely?

What is the expected security impact?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need before exploitation is possible?

Can this be exploited remotely?

What is the expected security impact?