Arubaos Cx
CVE-2026-23814
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
ExploitAccess AOS-CX CLI interface
-
ExecutionInject malicious commands via vulnerable parameter
-
ImpactExecute arbitrary code with elevated privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Low-privilege authenticated user account on AOS-CX device with CLI access enabled. Requires valid credentials and network access to management interface. |
| Impact | CVSS 8.8 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: Low. User interaction: None. Exploitation requires authentication. Exploitable via remote/network. |
| Exploit ScenarioDerived | A remote attacker (requires authentication) could exploit this vulnerability to a low-privilege authenticated remote attacker to inject malicious commands resul. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.
Earlier versions of this analysis (1)
A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior. [CVSS 8.8 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-77 (Command Injection). Affects the command component of command parameters of a certain AOS-CX CLI command. A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.
Know when Arubaos Cx gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionNVD
A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.
Executive ViewAI
A HIGH severity vulnerability (CVE-2026-23814) in AOS-CX CLI command processing allows authenticated users with low privileges to execute arbitrary commands, potentially compromising network infrastructure and data integrity. This poses significant risk to organizations running affected AOS-CX systems, as attackers with valid credentials can escalate capabilities and gain unauthorized control. No patch is currently available, requiring immediate implementation of compensating controls.
Restrict CLI access to trusted administrative networks using firewall rules and VPN enforcement; disable or restrict use of vulnerable command parameters if feature is non-critical; implement role-based access controls limiting CLI privileges to essential personnel only; deploy intrusion detection signatures to monitor for command injection patterns in AOS-CX traffic; enable audit logging and SIEM alerts for all CLI command executions; consider network segmentation to isolate affected AOS-CX devices; monitor vendor advisories closely for patch release and apply immediately upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Affected Products (CPE)NVD
Related Vulnerabilities in AOS-CX Switches Security Flaws
View all 5More in Arubaos Cx
View allAuthenticated remote attackers holding low-privilege management access to HPE Aruba Networking AOS-CX switches can injec
Authenticated command injection in HPE ArubaOS-CX allows a remote attacker who already holds valid management credential
An authenticated command injection vulnerability exists in the AOS-CX command line interface. Rated high severity (CVSS
An authenticated remote code execution vulnerability exists in the AOS-CX Network Analytics Engine. Rated high severity
A vulnerability in the SSH restricted shell interface of the network management services allows improper access control
ArubaOS-CX web management interface session fixation allows an authenticated remote attacker with low-privilege credenti
A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Rated medium severity (CVSS 6.8),
A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote at
GitHub PoC
Exploit-DB