What is the CVSS score of CVE-2026-23820?

CVE-2026-23820 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Arubaos Aos are affected by CVE-2026-23820?

Aruba Access Points running AOS-10 and AOS-8 Instant are vulnerable to an authenticated command injection that allows high-privileged administrators to execute arbitrary operating system commands,…

How to fix or mitigate CVE-2026-23820?

Within 24 hours: inventory all Aruba Access Points running AOS-10 or AOS-8 Instant and identify those exposing administrative CLI access via SSH or HTTPS to untrusted networks; immediately implement IP-based access restrictions for all administrative interfaces and disable remote administration where operationally feasible. Within 7 days: enable comprehensive logging of all administrative CLI sessions on affected AOS devices, implement real-time alerting for administrative login attempts, and rotate credentials for all accounts with administrative CLI access. Within 30 days: contact HPE/Aruba regarding patch availability and timeline for AOS-10 and AOS-8 Instant; if no patch is available within 90 days, develop a replacement or upgrade strategy for affected access point models.

Arubaos Aos CVE-2026-23820

EUVD-2026-29736 HIGH

OS Command Injection (CWE-78)

2026-05-12 hpe

GHSA-5f9x-4h79-7fqp

Command Injection Arubaos Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (hpe) · only source for this CVE.

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:06 vuln.today

CVE Published

May 12, 2026 - 18:34 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

AnalysisAI

Authenticated command injection in the ArubaOS (AOS) command line interface allows a high-privileged remote operator on Aruba Access Points running AOS-10 and AOS-8 Instant to break out of the restricted CLI shell and run arbitrary commands on the underlying operating system. HPE, the reporting vendor, classifies the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is low (0.12%), consistent with the CISA SSVC assessment of no known exploitation.