Skip to main content

Arubaos Cx CVE-2026-23813

CRITICAL
Improper Authentication (CWE-287)
2026-03-11 security-alert@hpe.com
9.8
CVSS 3.1 · Vendor: hpe
Share

Severity by source

Vendor (hpe) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 22:06 vuln.today
CVE Published
Mar 11, 2026 - 04:17 nvd
CRITICAL 9.8

DescriptionCVE.org

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

AnalysisAI

Auth bypass in HPE Aruba AOS-CX switch web management.

Technical ContextAI

CWE-287.

RemediationAI

Apply HPE update.

CVE-2026-23814 HIGH
8.8 Mar 11

Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achie

CVE-2023-3718 HIGH
8.8 Aug 01

An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS

CVE-2023-1168 HIGH
8.8 Mar 22

An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity

CVE-2026-23815 HIGH
7.2 Mar 11

Authenticated administrators of AOS-CX Switches can inject arbitrary commands through a custom binary in the CLI, potent

CVE-2026-23816 HIGH
7.2 Mar 11

Authenticated attackers can execute arbitrary OS commands on AOS-CX Switches through improper input validation in the CL

CVE-2026-23817 MEDIUM
6.5 Mar 11

web-based management interface of AOS-CX Switches is affected by url redirection to untrusted site (open redirect) (CVSS

CVE-2025-37160 MEDIUM
5.3 Nov 18

A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote at

CVE-2025-37159 MEDIUM
5.8 Nov 18

A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticate

CVE-2025-37158 MEDIUM
6.7 Nov 18

A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab

CVE-2025-37157 MEDIUM
6.7 Nov 18

A command injection vulnerability exists in the AOS-CX Operating System. Rated medium severity (CVSS 6.7), this vulnerab

CVE-2025-37156 MEDIUM
6.8 Nov 18

A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8),

CVE-2025-37155 HIGH
7.8 Nov 18

A vulnerability in the SSH restricted shell interface of the network management services allows improper access control

Share

CVE-2026-23813 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy