What is the CVSS score of CVE-2026-23813?

CVE-2026-23813 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-23813?

Within 24 hours: Inventory all AOS-CX switches in production; disable remote management access to affected devices or restrict to trusted administrative networks only; enable detailed logging on management interfaces. Within 7 days: Implement network segmentation to isolate switch management traffic; deploy monitoring/alerting for authentication bypass attempts; contact HPE Aruba for patch timeline. Within 30 days: Apply vendor patch immediately upon release; rotate all administrative credentials; conduct forensic review for unauthorized access attempts.

Arubaos Cx CVE-2026-23813

CRITICAL

Improper Authentication (CWE-287)

2026-03-11 security-alert@hpe.com

Authentication Bypass Arubaos Cx Hpe

9.8

CVSS 3.1 · NVD

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Send crafted request to management interface
Exploit

Bypass authentication controls
Execution

Reset admin password
Impact

Gain full device access

Vulnerability Assessment

Weakness	CWE CWE-287 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication mechanism validation MITRE ATT&CK 2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	AOS-CX switch with web-based management interface accessible on network. No authentication required. Affects default deployment configurations.
Impact	CVSS 9.8. Enterprise network switches.
Exploit ScenarioDerived	Bypass auth on switch management.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Auth bypass in HPE Aruba AOS-CX switch web management.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:06 CVSS 9.8

Auth bypass in AOS-CX switches.

RemediationAI

Apply HPE update.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-287.

Know when Arubaos Cx gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

DescriptionNVD

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

Executive ViewAI

Why It Matters

A critical vulnerability in AOS-CX switch management interfaces allows unauthenticated attackers to bypass authentication and potentially reset administrator passwords, creating direct risk to network infrastructure security and operational continuity. This affects any organization using these switches and requires immediate action since no patch is currently available.

Business Impact: Severe

Compensating Controls

Restrict management interface access via network ACLs to authorized administrative IP ranges only; disable remote management and require console-only access if feasible; implement virtual appliance-based WAF to block authentication bypass attempts on management ports; segment switch management traffic to isolated VLAN with strict ingress/egress controls; require multi-factor authentication at network perimeter for any remote access to management interfaces; enable comprehensive audit logging and alerting for failed authentication attempts; consider temporarily replacing critical affected switches with non-vulnerable alternatives until patch availability.

Threat Intelligence Overview

EPSS Score

0.1%

Top 85% exploitable

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.1%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.