HPE Aruba AOS CVE-2026-23825

Exploitation requires network path reachability to the vulnerable protocol-handling service on a device running an affected AOS-8 or AOS-10 build (AOS 10.4.0.0-10.4.1.10, 10.7.0.0-10.7.2.2, or 10.8.0.0); the attacker sends specially crafted network messages and needs no credentials, no user interaction, and no special client-side configuration (CVSS PR:N/UI:N/AC:L). What limits exploitation is exposure of that service: if the affected protocol port is reachable only from a segmented management/AP network, an external attacker cannot reach it. The impact is confined to a denial-of-service (single critical process termination, A:H, C:N/I:N) - there is no code execution or data disclosure, so the ceiling is availability loss rather than full compromise.

The signals are largely consistent and point to a genuine but availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) shows an easy, remote, unauthenticated attack with pure availability impact - no data compromise. Real-world exploitation pressure appears low: EPSS is 0.03% (9th percentile) and CISA SSVC lists Exploitation: none with Technical Impact: partial, indicating no observed exploitation and a bounded (single-process) effect. SSVC does flag Automatable: yes, meaning the attack could be scripted at scale if an exploit emerges, so the low EPSS should be read as 'not currently exploited' rather than 'hard to exploit.' Note a minor tagging inconsistency: the intelligence tags include 'Information Disclosure,' but both the description and the CVSS vector (C:N/I:N) indicate a denial-of-service condition only - the DoS characterization should be treated as authoritative and the 'Information Disclosure' tag appears to be a mislabel worth verifying with HPE. Overall this is a moderate-priority patch for exposed wireless infrastructure, not a critical emergency.

An attacker with network reachability to an Aruba controller or gateway sends a single specially crafted protocol message to the vulnerable service, tripping the input-validation flaw and terminating a critical daemon. Because the attack is unauthenticated, low-complexity, and flagged automatable, it could be repeated or scripted to keep the process - and the wireless service it supports - offline. No public exploit code is identified at time of analysis.