What is the CVSS score of CVE-2026-23821?

CVE-2026-23821 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of ArubaOS are affected by CVE-2026-23821?

HPE Aruba Networking Access Points running AOS-10 contain an authenticated command injection vulnerability (CVE-2026-23821) that could allow authorized administrators to execute arbitrary system…

How to fix or mitigate CVE-2026-23821?

Within 24 hours, conduct an inventory of all HPE Aruba Access Points and identify those running AOS-10.4.x, 10.7.x, or 10.8.0.0; document current high-privilege administrator accounts and review which systems have remote management enabled. Within 7 days, implement network segmentation by restricting administrative access to these devices to dedicated management VLANs only, enable comprehensive audit logging for all administrative commands, and disable remote management protocols (SSH, HTTPS) if operationally feasible. Within 30 days, establish bi-weekly monitoring of HPE security advisories for patch releases, conduct testing of firmware upgrades in your lab environment, and develop a production rollout plan for patched AOS-10 versions when available.

ArubaOS CVE-2026-23821

EUVD-2026-29737 HIGH

OS Command Injection (CWE-78)

2026-05-12 hpe

GHSA-38g8-3hc5-9xvj

Command Injection Arubaos Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable management plane with low complexity, but requires high-privilege admin access to submit configuration (PR:H); command execution yields full C/I/A impact on the device.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:04 vuln.today

CVE Published

May 12, 2026 - 18:35 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

AnalysisAI

Authenticated OS command injection in HPE Aruba Networking Access Points running ArubaOS (AOS-10) allows a high-privilege remote attacker to execute arbitrary system commands on the underlying operating system via flawed configuration-processing logic (CWE-78). Affected releases include AOS-10.4.x, 10.7.x, and 10.8.0.0; AOS-8 Instant software is explicitly not affected. There is no public exploit identified at time of analysis, and SSVC reflects no known exploitation with a low EPSS of 0.12%, though technical impact is rated total.

Technical ContextAI

The flaw resides in the configuration-processing logic of ArubaOS (AOS) on Aruba Networking Access Points, the operating system HPE ships for its enterprise wireless infrastructure. CWE-78 (Improper Neutralization of Special Elements used in an OS Command) indicates that attacker-influenced configuration input is passed to a system shell or command interpreter without adequate sanitization, letting crafted values break out into arbitrary OS-level commands. The single CPE, cpe:2.3:a:hewlett_packard_enterprise_(hpe):arubaos_(aos), confirms the affected component is the ArubaOS software itself rather than a specific hardware AP model, and the vendor notes the AOS-8 Instant code branch does not share this vulnerable logic.

RemediationAI

Patch available per vendor advisory: consult HPE Security Bulletin hpesbnw05049en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US) and upgrade ArubaOS to the fixed release identified by HPE for your branch - the affected trains are AOS 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, and 10.8.0.0, so move to the vendor-designated patched build above these ranges (exact fixed version not enumerated in the available data and should be taken from the bulletin). Because exploitation requires a high-privilege authenticated session, the most effective compensating controls are hardening administrative access: restrict management-plane and configuration access to a dedicated, firewalled management VLAN or out-of-band network, enforce strong per-admin credentials with MFA on the management interface, and apply least-privilege role separation so day-to-day operators cannot reach the vulnerable configuration paths - the trade-off being added operational friction for administrators. Also review and rotate any shared admin credentials and audit configuration-change logs; note that AOS-8 Instant deployments are unaffected and do not require this action.