CVE-2026-23821

High [CVE-2026-23821] AOS-10: vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions

CVE-2026-23821Source published May 12, 2026Source updated May 12, 2026

A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.

Affected products in this advisory

• AOS-10

Source-reported affected versions

• AOS-10 10.8.0.0
• AOS-10 10.7.0.0 through 10.7.2.2
• AOS-10 10.4.0.0 through 10.4.1.10

Source-reported fixed versions

• AOS-10 10.8.0.1 or above
• AOS-10 10.7.2.3 or above
• AOS-10 10.4.1.11 or above

Mitigation guidance

• Upgrade affected HPE Aruba Networking devices to an applicable fixed release: AOS-10 10.8.0.1 or above, AOS-10 10.7.2.3 or above, AOS-10 10.4.1.11 or above.
• To address this vulnerability, upgrade HPE Aruba Networking AOS-10 AP software to one of the following versions (as applicable): - AOS-10 AP 10.8.x.x: 10.8.0.1 and above - AOS-10 AP 10.7.x.x: 10.7.2.3 and above - AOS-10 AP 10.4.x.x: 10.4.1.11 and above

Workarounds

• To minimize the likelihood of an attacker exploiting this vulnerability, HPE Aruba Networking recommends that management interfaces be restricted to a dedicated layer 2 segment/VLAN and/or controlled by firewall policies at layer 3 and above, along with accounting controls for tracking and logging user activities and resource usage.