HPE Aruba AOS-8/10 AP Multiple Vulnerabilities Advisory (CVE-2026-23819/23820/23821/23822/23823): RCE, XSS, XXE

HPE Aruba Networking AOS-8 Instant AP and AOS-10 AP Multiple Vulnerabilities (HPESBNW00549 rev.1) Vulnerability Overview HPE Aruba Networking has released patches for Aruba Access Points running AOS-8 Instant and AOS-10 to address multiple security vulnerabilities. The potential security impacts include remote arbitrary command execution, cross-site scripting (XSS), and XML external entity (XXE) attacks. Affected Scope Affected Products: Access Points running AOS-8 Instant Access Points running AOS-10 AP Affected Software Versions: AOS-10 AP 10.8.x.x: 10.8.0.0 and earlier AOS-10 AP 10.7.x.x: 10.7.2.2 and earlier AOS-10 AP 10.4.x.x: 10.4.1.10 and earlier AOS-8 Instant 8.13.x.x: 8.13.1.1 and earlier AOS-8 Instant 8.12.x.x: 8.12.0.6 and earlier Detailed Vulnerability Information 1. XSS in AOS Web Interface (CVE-2026-23819) Description: A vulnerability in the web management interface of Access Points running AOS-10 and AOS-8 Instant, allowing unauthenticated remote attackers to execute arbitrary JavaScript code in the browser of a victim on the same local network. CVSS Score: 8.8 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H 2. Command Injection in AOS-8 and AOS-10 CLI (CVE-2026-23820) Description: A vulnerability in the command-line interface of Access Points running AOS-10 and AOS-8 Instant, allowing authenticated remote attackers to execute system commands within a restricted shell environment. CVSS Score: 7.2 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 3. Command Injection in AOS-10 CLI (CVE-2026-23821) Description: A vulnerability in the configuration processing logic of Access Points running AOS-10, allowing authenticated remote attackers to execute system commands under specific conditions. CVSS Score: 7.2 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 4. Command Injection in AOS-10 CLI Commands Leading to RCE (CVE-2026-23823) Description: A vulnerability in the command-line interface of Access Points running AOS-10, allowing authenticated remote attackers to execute command injection. CVSS Score: 7.2 (High) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Note: This vulnerability only affects Access Points running AOS-10.7.x.x and later. 5. XXE in AOS-8 DHCP Leading to Denial of Service (CVE-2026-23822) Description: A vulnerability in the XML processing component of the AOS-8 DHCP service, allowing unauthenticated remote attackers to trigger a denial of service condition. CVSS Score: 5.3 (Medium) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H Note: This vulnerability only affects systems running AOS-8.x. Remediation It is recommended to upgrade to any of the following versions within the affected software branches: AOS-10 AP 10.8.x.x: 10.8.0.1 and later AOS-10 AP 10.7.x.x: 10.7.2.3 and later AOS-10 AP 10.4.x.x: 10.4.1.11 and later AOS-8 Instant 8.13.x.x: 8.13.1.2 and later AOS-8 Instant 8.12.x.x: 8.12.0.7 and later AOS-8 Instant 8.10.x.x: 8.10.2.2 and later Mitigation Measures: Restrict the management interface to a dedicated Layer 2 segment/VLAN and control it via firewall policies at Layer 3 and above. Implement access controls to monitor and log user activities and resource usage.

Goal Reached Thanks to every supporter — we hit 100%!

HPE Aruba AOS-8/10 AP Multiple Vulnerabilities Advisory (CVE-2026-23819/23820/23821/23822/23823): RCE, XSS, XXE

More from this source