Command Injection Vulnerability in HPE Access Points Running AOS-10
CVE-2026-23823

7.2HIGH

Key Information:

Vendor

HP (HP)

Status
Arubaos (aos)
Vendor
CVE Published:
12 May 2026

What is CVE-2026-23823?

A command injection vulnerability exists in the command line interface of HPE Access Points that run on AOS-10. This issue can be exploited by an authenticated remote attacker, granting them the ability to execute arbitrary commands on the underlying operating system. It's essential to note that this vulnerability specifically affects AOS-10.7.x.x and above versions; earlier versions, including AOS-10.4 and AOS-8, are not impacted. Administrators should consider upgrading to mitigate risks associated with this vulnerability.

Affected Version(s)

ArubaOS (AOS) 10.8.0.0

ArubaOS (AOS) 10.8.0.0

ArubaOS (AOS) 10.7.0.0 <= 10.7.2.2

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpe...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This vulnerability was discovered and reported by erikdejong through HPE Aruba Networking's Bug Bounty program
.