Medium [CVE-2026-23822] AOS-8: vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition
This medium-severity HPE Aruba Networking advisory covers CVE-2026-23822 affecting AOS-8.
Android app · Google Play
Monitor future HPE Aruba Networking CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system.
NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x
- Instant AP 8.13.0.0 through 8.13.1.1
- Instant AP 8.12.0.0 through 8.12.0.6
- Instant AP 8.10.0.0 through 8.10.0.21
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
- Instant AP 8.13.1.2 or above
- Instant AP 8.12.0.7 or above
- Instant AP 8.10.0.22 or above
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Mitigation checklist
- Upgrade affected HPE Aruba Networking devices to an applicable fixed release: Instant AP 8.13.1.2 or above, Instant AP 8.12.0.7 or above, Instant AP 8.10.0.22 or above.
- To address this vulnerability, upgrade HPE Aruba Networking AOS-8 Instant software to one of the following versions (as applicable): - AOS-8 Instant 8.13.x.x: 8.13.1.2 and above - AOS-8 Instant 8.12.x.x: 8.12.0.7 and above - AOS-8 Instant 8.10.x.x: 8.10.0.22 and above
- To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.
Official advisory · high-confidence parse· fetched 1 month ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.