What is the CVSS score of CVE-2026-23814?

CVE-2026-23814 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Arubaos Cx are affected by CVE-2026-23814?

A HIGH severity vulnerability (CVE-2026-23814) in AOS-CX CLI command processing allows authenticated users with low privileges to execute arbitrary commands, potentially compromising network…

How to fix or mitigate CVE-2026-23814?

Within 24 hours: Inventory all AOS-CX deployments and identify systems running vulnerable versions; disable CLI command parameter processing where operationally feasible or restrict CLI access to trusted administrative networks only. Within 7 days: Implement network segmentation to isolate AOS-CX management interfaces; enforce multi-factor authentication for all CLI access; establish enhanced monitoring and logging of all CLI command executions. Within 30 days: Contact vendor for patch availability and timeline; develop and test remediation plan including system upgrades; conduct security audit of recent CLI access logs for signs of exploitation.

Arubaos Cx CVE-2026-23814

HIGH

Command Injection (CWE-77)

2026-03-11 security-alert@hpe.com

Command Injection Arubaos Cx Hpe

8.8

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 04:17 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.

AnalysisAI

Authenticated remote attackers can execute arbitrary commands through malformed parameters in AOS-CX CLI commands, achieving remote code execution with high integrity and confidentiality impact. The vulnerability affects low-privileged users on networked systems and requires no user interaction to exploit. No patch is currently available for this command injection flaw.

Technical ContextAI

Classified as CWE-77 (Command Injection). Affects the command component of command parameters of a certain AOS-CX CLI command. A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.