High7.2HPE Aruba Networking

High [CVE-2026-23821] AOS-10: vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions

This high-severity HPE Aruba Networking advisory covers CVE-2026-23821 affecting AOS-10, AOS-8.

CVE-2026-23821 Published May 12, 2026Updated by vendor Aug 12, 2026

CVE-2026-23821

Affected products & platforms

HPE Aruba NetworkingAOS-10AOS-8 MobilityWireless & ControllersInstantArubaOS

Open vendor advisory

Android app · Google Play

Monitor future HPE Aruba Networking CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

Affected versions

AOS-10 10.8.0.0
AOS-10 10.7.0.0 through 10.7.2.2
AOS-10 10.4.0.0 through 10.4.1.10

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Fixed versions

AOS-10 10.8.0.1 or above
AOS-10 10.7.2.3 or above
AOS-10 10.4.1.11 or above

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Mitigation checklist

Recommended fix / mitigation

Upgrade affected HPE Aruba Networking devices to an applicable fixed release: AOS-10 10.8.0.1 or above, AOS-10 10.7.2.3 or above, AOS-10 10.4.1.11 or above.
To address this vulnerability, upgrade HPE Aruba Networking AOS-10 AP software to one of the following versions (as applicable): - AOS-10 AP 10.8.x.x: 10.8.0.1 and above - AOS-10 AP 10.7.x.x: 10.7.2.3 and above - AOS-10 AP 10.4.x.x: 10.4.1.11 and above

Temporary workarounds

To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.

Official advisory · high-confidence parse· fetched 1 month ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Official vendor advisoryofficial
Official advisory page fetched and parsed for the summary, affected/fixed versions and remediation guidance it provides.
HPE Aruba Networking
NVD discovery recordNVD
Independent discovery and scoring cross-reference. Vendor remediation guidance takes precedence. Discovered from the machine-readable feed https://services.nvd.nist.gov/rest/json/cves/2.0; this link opens the NVD record for CVE-2026-23821 instead of the raw feed document.
NIST National Vulnerability Database

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-23821NVD CVE.org MITRE

Official resources

AOS-10 gateway & AP release notes (target: 10)
Official documentation
This advisory names 10 as the first fixed release — official upgrade documentation for AOS-10 gateway & AP release notes.
HPE Security Bulletin Library (Aruba PSIRT)
Official documentation
Official HPE/Aruba security bulletins — the canonical affected/fixed version table for this CVE.
HPE Networking Support Portal (software downloads)
Official documentation
Official download location for the fixed ArubaOS / AOS-CX / ClearPass / Instant builds.

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.