What is the CVSS score of CVE-2026-23826?

CVE-2026-23826 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Aruba AOS-8 are affected by CVE-2026-23826?

HPE Aruba Wireless Controllers running AOS-8 (versions 8.10.x-8.13.x) are vulnerable to remote, unauthenticated denial-of-service attacks that crash the management service and disrupt network…

How to fix or mitigate CVE-2026-23826?

Within 24 hours: Identify and inventory all HPE Aruba AOS-8 controllers (versions 8.10.x, 8.12.x, 8.13.x) in production and restrict management interface access to trusted administrative networks via firewall rules and network segmentation. Within 7 days: Contact HPE Aruba support to confirm patch timelines and end-of-life status for your deployed versions; implement rate limiting and packet filtering on management service ports; enable enhanced logging for service restarts and management interface access. Within 30 days: Develop an upgrade strategy to transition to patched AOS-8 releases when vendor-released patches become available, or evaluate migration to newer Aruba OS platforms; conduct lab testing of patches prior to production deployment.

Aruba AOS-8 CVE-2026-23826

EUVD-2026-29752 HIGH

Allocation of Resources Without Limits or Throttling (CWE-770)

2026-05-12 hpe

GHSA-4h6r-mccq-vg7c

Denial Of Service Hpe Aruba Networking Wireless Operating System Aos Hewlett Packard Enterprise Hpe

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable crafted packets (AV:N/AC:L/PR:N/UI:N) crash a service with availability-only impact (A:H), no confidentiality or integrity loss, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 19:58 vuln.today

CVE Published

May 12, 2026 - 18:53 nvd

HIGH 7.5

DescriptionCVE.org

A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.

AnalysisAI

Denial-of-service in HPE Aruba Networking Wireless Operating System (AOS-8) lets an unauthenticated remote attacker crash a network management service by sending specially crafted packets, terminating the service process and disrupting normal controller operations. Affected releases include AOS 8.10.x, 8.12.x, and 8.13.x up to the fixed builds. There is no public exploit identified at time of analysis, and EPSS is low (0.08%), consistent with SSVC exploitation status of 'none' - this is a patch-worthy availability issue rather than an active threat.

Technical ContextAI

AOS-8 is the operating system running on HPE Aruba mobility controllers/wireless LAN gateways that manage large fleets of access points. The flaw resides in a network management service exposed on the device and is classified as CWE-770 (Allocation of Resources Without Limits or Throttling), meaning crafted traffic can drive the service to consume or mishandle resources until its process terminates unexpectedly. Per the CPE, the affected component is cpe:2.3:a:hewlett_packard_enterprise_(hpe):hpe_aruba_networking_wireless_operating_system_(aos), i.e. the controller-side AOS network stack rather than any third-party library.

RemediationAI

Upgrade to a fixed AOS-8 maintenance build above the affected ranges - for the 8.10 branch install a release later than 8.10.0.21, for 8.12 later than 8.12.0.6, and for 8.13 later than 8.13.1.1 (confirm exact patched build numbers in the HPE advisory at https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US, as fixed versions were not enumerated in the input). Because exploitation targets a network management service, the primary compensating control until patching is to restrict reachability of that management service: place controller management interfaces on an isolated management VLAN, apply control-plane/ACL policing so only trusted management hosts can send to the affected service, and block untrusted access to management ports at the perimeter - the trade-off is that overly tight ACLs can disrupt legitimate management, monitoring, or clustering traffic, so validate rules against your NMS and controller-to-controller communication first.