What is the CVSS score of CVE-2026-23823?

CVE-2026-23823 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ArubaOS are affected by CVE-2026-23823?

HPE Aruba Access Points running AOS-10.7 and later contain an authenticated command injection vulnerability that enables high-privileged operators to execute arbitrary system commands on critical…

How to fix or mitigate CVE-2026-23823?

Within 24 hours, inventory all HPE Aruba APs running AOS-10.7.x or later, enumerate all accounts with CLI administrative access, and review recent management session logs for anomalous activity. Over the next 7 days, restrict CLI access exclusively to a hardened management jump host or VPN requiring multi-factor authentication, implement network segmentation to isolate AP management traffic from general network access, and disable remote CLI access on APs where local or indirect management is operationally feasible. Within 30 days, develop and execute an upgrade migration plan to move affected APs to AOS-10.4 or AOS-8 Instant (confirmed unaffected versions), or implement alternative out-of-band management channels until HPE releases a patch for the 10.7+ branch.

ArubaOS CVE-2026-23823

EUVD-2026-29739 HIGH

Command Injection (CWE-77)

2026-05-12 hpe

GHSA-fmjq-w5wp-977g

Command Injection Arubaos Aos Hewlett Packard Enterprise Hpe

7.2

CVSS 3.1 · Vendor: hpe

Severity by source

Vendor (hpe) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-reachable CLI (AV:N/AC:L) but requires existing admin privileges (PR:H); command injection yields full OS control, so C/I/A all High with unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hpe).

CVSS VectorVendor: hpe

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 20:00 vuln.today

CVE Published

May 12, 2026 - 18:38 nvd

HIGH 7.2

DescriptionCVE.org

A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability.

AnalysisAI

Authenticated command injection in the command line interface of HPE Aruba Access Points running AOS-10 (10.7.x and above) lets a high-privileged remote operator break out of the CLI and run arbitrary operating-system commands on the underlying AP. HPE self-reported the flaw (CWE-77) with a CVSS 7.2 rating and total technical impact per CISA SSVC, though there is no public exploit identified at time of analysis and EPSS estimates only a 0.19% (40th percentile) exploitation probability. Notably, AOS-10.4 APs and the AOS-8 Instant branch are explicitly not affected, narrowing the exposed fleet.

Technical ContextAI

The affected component is the management CLI exposed by HPE Aruba campus Access Points operating in the AOS-10 cloud-managed architecture (CPE cpe:2.3:a:hewlett_packard_enterprise_(hpe):arubaos_(aos)). CWE-77 (Improper Neutralization of Special Elements used in a Command) indicates the CLI passes operator-supplied input into an underlying shell or system call without adequate sanitization, so shell metacharacters (e.g. ;, |, `, $()) injected into a CLI parameter are interpreted by the host OS rather than treated as literal data. Because AOS-10 APs run a Linux-based firmware, successful injection yields code execution in the AP's OS context. The version boundary (AOS-10.7.0.0 and above affected, AOS-10.4 and AOS-8 Instant unaffected) suggests the vulnerable CLI handler was introduced or changed in the 10.7 code branch.

RemediationAI

Consult the HPE security advisory hpesbnw05049en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US) and upgrade AOS-10 Access Point firmware to the fixed release identified there; the input data confirms a vendor advisory but does not enumerate an exact fixed version, so treat patch status as 'Patch available per vendor advisory' and verify the precise fixed build (above 10.7.2.2 / 10.8.0.0) directly with HPE before deployment. As compensating controls until patched, restrict who holds administrative CLI credentials on AOS-10 APs and enforce least privilege, since exploitation requires high privileges; limit management-plane access by binding SSH/CLI to a dedicated management VLAN and applying ACLs so only authorized admin workstations can reach the AP CLI (trade-off: legitimate remote administration must traverse the management network); and enable command auditing/logging on the management interface to detect anomalous CLI usage (trade-off: added log volume but no operational disruption). Organizations still on AOS-10.4 or AOS-8 Instant are not affected and need no action for this CVE.