What is the CVSS score of CVE-2026-23825?

CVE-2026-23825 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of HPE Aruba AOS are affected by CVE-2026-23825?

HPE Aruba Networking wireless controllers running AOS-8 or AOS-10 are vulnerable to remote, unauthenticated denial-of-service attacks that disable critical system processes, potentially causing…

How to fix or mitigate CVE-2026-23825?

Within 24 hours, inventory all HPE Aruba wireless controllers running AOS-8 or AOS-10 and implement network-level access controls restricting the protocol-handling service ports to authorized management interfaces only; block untrusted network paths to these services. Within 7 days, deploy packet filtering and anomaly detection monitoring for malformed network messages to the affected services; enable wireless controller redundancy and automatic failover if available. Within 30 days, establish continuous monitoring of HPE Aruba security advisories for patch availability and develop a staged firmware upgrade plan for all affected systems, targeting the earliest available patched AOS-8 or AOS-10 release.

HPE Aruba AOS CVE-2026-23825

EUVD-2026-29751 HIGH

Improper Input Validation (CWE-20)

2026-05-12 hpe

GHSA-6267-3wmp-x754

Information Disclosure Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote unauthenticated crafted-message DoS needs no privileges or interaction (AV:N/AC:L/PR:N/UI:N); impact is process termination only, so C:N/I:N/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:59 vuln.today

CVE Published

May 12, 2026 - 18:52 nvd

HIGH 7.5

DescriptionCVE.org

Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

AnalysisAI

Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8 and AOS-10) allows a remote unauthenticated attacker to crash a critical system process by sending specially crafted network messages to a protocol-handling service (CWE-20, insufficient input validation). Reported by HPE with no public exploit identified at time of analysis; EPSS is very low (0.03%, 9th percentile) and CISA SSVC records exploitation status as none, though the flaw is rated automatable. Impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.

Technical ContextAI

The affected component is a protocol-handling service within Aruba's wireless controller/gateway operating systems (AOS-8 on legacy Mobility Controllers and AOS-10 on the cloud-native Aruba Central architecture), which power enterprise Wi-Fi infrastructure including Mobility Conductors, gateways, and access points. The root cause is CWE-20 (Improper Input Validation): the service fails to adequately validate the structure or contents of inbound network messages, and a malformed message drives a critical daemon into an unhandled error state that terminates the process. The CPE identifies the affected product as cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos). Because the crash targets a critical process, the effect is loss of the network service the process provides rather than code execution or data exposure.

RemediationAI

Apply the fixed AOS releases identified in HPE security bulletin hpesbnw05048en_us (https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US); the provided data confirms affected trains (10.4.x ≤10.4.1.10, 10.7.x ≤10.7.2.2, 10.8.0.0, and AOS-8) but does not enumerate the exact patched build numbers, so consult the bulletin for the precise target version for your branch (Patch available per vendor advisory; exact fix version not independently confirmed from the provided data - do not assume a version). As a compensating control until patched, restrict network reachability of the affected protocol-handling service: place management and controller-to-controller/AP protocol interfaces on isolated management VLANs, and use ACLs or firewall rules to permit the affected service only from trusted AP and controller subnets, blocking untrusted or internet-facing sources. The trade-off is that overly tight filtering can disrupt legitimate AP-to-controller or controller-to-conductor communication and roaming, so validate that management, tunnel, and clustering traffic between your own Aruba nodes is still permitted before enforcing.