A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.

A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.

A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.

A vulnerability have been identified in the management interface of AOS-S that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to gain unauthorized access to the affected system.

Mail from HPE/Aruba. Most notable is a CVE with score of 9.8 "Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset"

HPE Aruba Networking Product Security Advisory ============================================== Advisory ID: HPESBNW05027 CVE: CVE-2026-23813, CVE-2026-23814, CVE-2026-23815, CVE-2026-23816, CVE-2026-23817 Publication Date: 2026-Mar-10 Status: Confirmed Severity: Critical Revision: 1

Title ===== HPE Aruba Networking AOS-CX, Multiple Vulnerabilities

Overview ======== HPE Aruba Networking has released AOS-CX software patches to address multiple security vulnerabilities.

Affected Products ================= HPE Aruba Networking AOS-CX Software Version(s):

- AOS-CX 10.17.xxxx: 10.17.0001 and below - AOS-CX 10.16.xxxx: 10.16.1020 and below - AOS-CX 10.13.xxxx: 10.13.1160 and below - AOS-CX 10.10.xxxx: 10.10.1170 and below

Software versions of AOS-CX that are End of Support at the time of publication of this security advisory are expected to be affected by these vulnerabilities unless otherwise indicated.

Unaffected Products ================= Any other HPE Aruba Networking products not specifically listed above are not affected by these vulnerabilities.

Details =======

Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset (CVE-2026-23813) - --------------------------------------------------------------------- A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

Internal References: VULN-149 Severity: Critical CVSSv3.1 Base Score: 9.8 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Discovery: This vulnerability was discovered and reported by moonv through HPE Aruba Networkings Bug Bounty program.

Workaround: To mitigate the exposure of this vulnerability, HPE Aruba Networking recommends the following mitigation measures: Restrict access to all management interfaces to a dedicated Layer 2 segment or VLAN to isolate management traffic from general network traffic. Implement strict policies at Layer 3 and above to control access to management interfaces, permitting only authorized and trusted hosts. Disable HTTP(S) interfaces on Switched Virtual Interfaces (SVIs) and routed ports wherever management access is not required. Enforce Control Plane Access Control Lists (ACLs) to protect any REST/HTTP-enabled management interfaces, ensuring only trusted clients are allowed to connect to the HTTPS/REST endpoints. Enable comprehensive accounting, logging, and monitoring of all management interface activities to detect and respond to unauthorized access attempts promptly.

Authenticated Command Injection found in AOS-CX CLI Command (CVE-2026-23814) - --------------------------------------------------------------------- A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.

Internal References: VULN-137 Severity: High CVSSv3.1 Base Score: 8.8 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Discovery: This vulnerability was discovered by the National Cybersecurity Agency of Italy (ACN).

Workaround: To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.

Authenticated Command Injection found in AOS-CX Administrative CLI Command (CVE-2026-23815) - --------------------------------------------------------------------- A vulnerability in a custom binary used in AOS-CX Switches’ CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.

Internal References: VULN-147, VULN-230 Severity: High CVSSv3.1 Base Score: 7.2 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Discovery: This vulnerability was discovered and reported by moonv through HPE Aruba Networkings Bug Bounty program.

Workaround: To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.

Authenticated Command Injection found in admin AOS-CX CLI command (CVE-2026-23816) - --------------------------------------------------------------------- A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Internal References: VULN-148 Severity: High CVSSv3.1 Base Score: 7.2 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Discovery: This vulnerability was discovered and reported by moonv through HPE Aruba Networkings Bug Bounty program.

Workaround: To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.

Unauthenticated Open Redirect allows URL Manipulation in Web Interface (CVE-2026-23817) - --------------------------------------------------------------------- A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users to an arbitrary URL.

Internal References: VULN-58 Severity: Medium CVSSv3.1 Base Score: 6.5 CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Discovery: This vulnerability was discovered by Christopher Simmelink through HPE Aruba Networking’s Bug Bounty program.

Workaround: To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.

Resolution ========== To address the vulnerabilities described above in the affected software branches, it is recommended to upgrade HPE Networking AOS-CX to one of the following versions (as applicable):

- AOS-CX 10.17.xxxx: AOS-CX 10.17.1001 and above - AOS-CX 10.16.xxxx: AOS-CX 10.16.1030 and above - AOS-CX 10.13.xxxx: AOS-CX 10.13.1161 and above - AOS-CX 10.10.xxxx: AOS-CX 10.10.1180 and above

Software versions with resolution/fixes for the vulnerabilities covered above can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/home/

HPE Aruba Networking does not evaluate or patch software branches that have reached their End of Maintenance (EoM) milestone. For more information about HPE Aruba Networking End of Life policy please visit:

https://www.hpe.com/psnow/doc/a00143052enw

Workaround ========== Vulnerability specific workarounds are listed per vulnerability above. You may contact HPE Services - HPE Aruba Networking for assistance if needed. For more information, please visit HPE Networking Support Portal at https://networkingsupport.hpe.com/home.

Exploitation and Public Discussion ================================== HPE Aruba Networking is not aware of any public discussion or exploit code targeting these specific vulnerabilities as of the release date of the advisory.

Revision History ================ Revision 1 / 2026-Mar-10 / Initial release

HPE Aruba Networking SIRT Security Procedures ============================================== Complete information on reporting security vulnerabilities in HPE Aruba Networking products and obtaining assistance with security incidents is available at: http://www.hpe.com/support/security-response-policy

For reporting NEW HPE Aruba Networking security issues, email can be sent to networking-sirt@hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: https://www.hpe.com/info/psrt-pgp-key

(c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information --

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-23600.

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2026-23600.

A remote authentication bypass vulnerability

exists in HPE AutoPass License Server (APLS).

A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking ClearPass OnGuard Software for Linux. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges.

Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.

A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory.

A vulnerability was discovered in the storage policy for certain sets of encryption keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

A vulnerability was discovered in the storage policy for certain sets of authentication keys in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

A vulnerability was discovered in the storage policy for certain sets of sensitive credential information in the HPE Telco Network Function Virtual Orchestrator. Successful Exploitation could lead to unauthorized parties gaining access to sensitive system information.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-37105.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2025-37105.

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2025-37107.

This vulnerability allows remote attackers to bypass authentication on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2025-37107.

This vulnerability allows remote attackers to disclose sensitive information or edit configuration on affected installations of Hewlett Packard Enterprise AutoPass License Server. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.3. The following CVEs are assigned: CVE-2025-37106.