Vulnerability in Standardized Wireless Roaming Protocol Affecting HPE Products
CVE-2026-23808

5.4MEDIUM

Key Information:

Vendor

HP (HP)

Status
HP Aruba Networking Wireless Operating System (aos-10 & Aos-8)
Vendor
CVE Published:
4 March 2026

What is CVE-2026-23808?

A vulnerability has been detected within a widely used wireless roaming protocol that may allow a malicious actor to implant a counterfeit Group Temporal Key (GTK) on a client device. If successfully exploited, this vulnerability could enable the remote adversary to inject unauthorized data frames, circumvent client isolation measures, interfere with traffic between clients, and jeopardize the overall integrity and confidentiality of network segmentation.

Affected Version(s)

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.8.0.0

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.8.0.0

HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8) 10.7.0.0 <= 10.7.2.2

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Xin'an Zhou, Juefei Pu, Zhutian Liu, Zhiyun Qian, Zhaowei Tan,Srikanth V. Krishnamurthy from University of California, and Mathy Vanhoef from DistriNet, KU Leuven
.