Private 5G Core CVE-2026-23818

Requires HPE Aruba Networking Private 5G Core On-Prem GUI login functionality. Attacker crafts malicious URL and sends to target user. Victim must click the link, triggering open redirect to attacker-controlled spoofed login page where credentials are harvested. No authentication required initially.

Real-world risk is moderate to high despite the 8.8 CVSS score. The CVSS vector shows this is remotely exploitable without authentication (PR:N) but requires user interaction (UI:R), meaning successful exploitation depends on social engineering rather than automated scanning. Attack complexity is low (AC:L), making weaponization straightforward once victims click malicious links. The high impact ratings (C:H/I:H/A:H) reflect that credential theft could grant full administrative access to private 5G core infrastructure. However, no EPSS score is available, no CISA KEV listing exists, and no public exploit code has been identified, suggesting exploitation has not been observed in the wild. The primary risk comes from targeted phishing campaigns against network administrators rather than mass exploitation. Organizations using HPE Aruba Private 5G Core should prioritize this based on their threat model-particularly if users frequently access the GUI from uncontrolled networks or via emailed links. The vulnerability requires user action, reducing automated exploitation risk but maintaining significant social engineering exposure.

An attacker researches an organization using HPE Aruba Private 5G Core and crafts a phishing email appearing to originate from IT support, containing a URL that looks legitimate but includes malicious redirect parameters in the login flow. When a network administrator clicks the link, they are taken through what appears to be the normal Private 5G Core login process but are seamlessly redirected to an attacker-controlled server hosting a pixel-perfect replica of the login page. The victim enters their credentials believing they are authenticating to their organization's 5G infrastructure. The attacker captures these credentials in real-time and redirects the victim back to the legitimate login page, where they authenticate successfully, remaining unaware of the compromise. The attacker now possesses valid credentials to access and potentially manipulate critical private 5G network infrastructure.