Aruba AOS-CX CVE-2026-23816

Exploitation requires authenticated access to the AOS-CX switch command line interface with at least low-privilege credentials (CVSS PR:L; the description explicitly states 'authenticated remote attacker'). The attacker must reach the CLI over the network (SSH/console management plane) and supply crafted input to a specific CLI command that improperly passes arguments to the underlying OS. Limiting factors: valid CLI credentials are mandatory (no unauthenticated path), and exposure depends on whether the switch management interface is reachable by the attacker - best practice of isolating the management plane on a dedicated VLAN/network substantially reduces reachable attack surface. No user interaction is required (UI:N).

This is a classic CWE-78 OS command injection in the AOS-CX switch CLI, rated CVSS 8.8 (High) by HPE with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The signals are internally consistent but nuanced: the network attack vector and low complexity are offset by PR:L, meaning the attacker must already hold valid (even low-privilege) authenticated CLI access to the switch - this is not an unauthenticated pre-auth flaw. EPSS is low at 0.12% (31st percentile), and there is no CISA KEV listing and no public exploit code identified at time of analysis, so there is no evidence of active or widespread exploitation - the risk is currently latent rather than imminent. No SSVC decision data was provided in the input. The realistic priority is moderate-to-high for organizations exposing switch management interfaces to semi-trusted operators, because the impact is total (full C:H/I:H/A:H via OS-level command execution, effectively a privilege escalation from constrained CLI to underlying OS), but the authentication requirement and absence of exploitation signals argue against emergency patching over routine prioritized remediation. Note the CPE list contains four identical unpinned arubaos-cx entries with wildcard versions, so exact affected version ranges are NOT specified in the provided data and must be confirmed against HPE bulletin hpesbnw05027en_us.

An attacker with low-privilege authenticated CLI access to an AOS-CX switch (a rogue network operator, or an adversary who has phished/reused management credentials) issues a crafted CLI command whose arguments are passed unsanitized into an underlying OS shell invocation, breaking out of the constrained CLI to run arbitrary commands on the switch's Linux-based OS. This yields full control of the switch - traffic interception, configuration tampering, or persistence. No public proof-of-concept exploit has been identified at time of analysis.