Aruba AOS-8 CVE-2026-23826

Exploitation requires network reachability to the affected AOS-8 network management service on an Aruba controller/gateway running 8.10.0.0-8.10.0.21, 8.12.0.0-8.12.0.6, or 8.13.0.0-8.13.1.1; the attacker sends specially crafted packets to that service. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication and no user interaction are needed against affected default configurations. The key limiting factor is exposure: the attacker must be able to route packets to the management service, so controllers whose management plane is isolated on a restricted VLAN or protected by ACLs are far harder to reach. Impact is availability-only (A:H, C:N/I:N) - a service crash/DoS, not code execution or data disclosure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a low-complexity, network-reachable, unauthenticated attack with pure availability impact - no confidentiality or integrity loss. Signals are internally consistent but point to moderate real-world priority: EPSS is only 0.08% (24th percentile), the vuln is not on CISA KEV, and SSVC reports Exploitation: none with Technical Impact: partial. SSVC does flag Automatable: yes, so if exploit code ever emerges the attack could be scripted against many controllers. Net: a genuine but non-urgent DoS - prioritize patching on internet-exposed or management-plane-reachable controllers, but there is no evidence this is a high-real-risk 'exploit now' issue despite the 7.5 rating.

An attacker with network reachability to a controller's management service crafts and sends malformed packets to that service without any credentials or user interaction, causing the process to terminate and interrupting AP/controller operations. Repeating the packets could sustain the outage. No public exploit code has been identified, so this remains a plausible but currently theoretical attack.