HPE warns of critical AOS-CX flaw allowing admin password resets

Hewlett Packard Enterprise (HPE) has patched multiple security vulnerabilities in the Aruba Networking AOS-CX operating system, including several authentication and code execution issues. AOS-CX is a cloud-native network operating system (NOS) developed by HPE subsidiary Aruba Networks for the company's CX-series campus and data center switch devices. The most severe security flaw today is a critical authentication bypass vulnerability (tracked as CVE-2026-23813) that attackers without privileges can exploit in low-complexity attacks to reset admin passwords. "A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password," HPE said. "HPE Aruba Networking is not aware of any public discussion or exploit code targeting these specific vulnerabilities as of the release date of the advisory." IT admins who can't immediately apply today's security updates to patch vulnerable switches can take one of the following mitigation measures: HPE has yet to find publicly available proof-of-concept exploit code or evidence that attackers are abusing the vulnerabilities in the wild. In July 2025, the company also warned of hardcoded credentials in Aruba Instant On Access Points that could allow attackers to bypass standard device authentication. One month earlier, HPE patched eight vulnerabilit...