CVE-2026-23824: Aruba AOS-10: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems
This Aruba advisory covers CVE-2026-23824 in AOS-10.
- CVE-2026-23824
Key facts
- Vendor rating
- High, CVSS 7.5
- CISA KEV
- Not listed (catalogue checked )
- Affected
- AOS-10 10.8.0.0; AOS-10 10.7.0.0 through 10.7.2.2; AOS-10 10.4.0.0 through 10.4.1.10
- Fixed in
- AOS-10 10.8.0.1 or above, AOS-10 10.7.2.3 or above, AOS-10 10.4.1.11 or above
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service.
Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
Text from the source record.
- AOS-10 10.8.0.0
- AOS-10 10.7.0.0 through 10.7.2.2
- AOS-10 10.4.0.0 through 10.4.1.10
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2026-23824
Upgrade to a fixed release named by Aruba:
- AOS-10 10.8.0.1 or above
- AOS-10 10.7.2.3 or above
- AOS-10 10.4.1.11 or above
Vendor guidance
- Upgrade affected HPE Aruba Networking devices to an applicable fixed release: AOS-10 10.8.0.1 or above, AOS-10 10.7.2.3 or above, AOS-10 10.4.1.11 or above.
- Upgrade Mobility Conductors, Controllers, and Gateways to one of the following AOS-10 or AOS-8 versions (as applicable) to resolve the vulnerabilities described in the details section: - AOS-10.8.x.x: 10.8.0.1 and above; - AOS-10.7.x.x: 10.7.2.3 and above; - AOS-10.4.x.x: 10.4.1.11 and above.
Workarounds
- To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that the CLI and web-based management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.
More HPE Aruba Networking advisories
CVE-2026-44874May 12, 2026AOS-10: vulnerability exists in the web-based management interface of an AOS-10 GatewayCVE-2026-44872May 12, 2026AOS-10: command injection vulnerability exists in the web-based management interfaceCVE-2026-44870May 12, 2026AOS-10: Command injection vulnerabilities exist in the command line interface (CLI)CVE-2026-44869May 12, 2026AOS-10: Command injection vulnerabilities exist in the web-based management interfaceCVE-2026-44868May 12, 2026AOS-10: Command injection vulnerabilities exist in the web-based management interfaceCVE-2026-44867May 12, 2026AOS-10: Command injection vulnerabilities exist in the web-based management interface
HPE Aruba Networking advisories, May 2026All HPE Aruba Networking advisories
Get an email when Aruba AOS-10 Gateways & APs publishes the next one.
See Aruba AOS-10 Gateways & APs's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future HPE Aruba Networking CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
