CVE-2026-23826

A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::
	cpe:2.3:o:arubanetworks:arubaos::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:arubanetworks:sd-wan::::::::
	cpe:2.3:a:arubanetworks:sd-wan::::::::

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad en un servicio de gestión de red del sistema operativo AOS-8 podría permitir a un atacante remoto no autenticado explotar esta vulnerabilidad enviando paquetes de red especialmente diseñados al dispositivo afectado, lo que podría resultar en una condición de denegación de servicio. La explotación exitosa podría causar que el proceso del servicio afectado termine inesperadamente, interrumpiendo las operaciones normales del dispositivo.

Information

Published : 2026-05-12 20:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-23826

Mitre link : CVE-2026-23826

CVE.ORG link : CVE-2026-23826

JSON object : View

Products Affected

arubanetworks

arubaos
sd-wan

CWE

CWE-770

Allocation of Resources Without Limits or Throttling

{"id": "CVE-2026-23826", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23826", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:45:15.478850Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-alert@hpe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-alert@hpe.com", "affectedData": [{"vendor": "Hewlett Packard Enterprise (HPE)", "product": "HPE Aruba Networking Wireless Operating System (AOS)", "versions": [{"status": "affected", "version": "8.13.0.0", "versionType": "semver", "lessThanOrEqual": "8.13.1.1"}, {"status": "affected", "version": "8.12.0.0", "versionType": "semver", "lessThanOrEqual": "8.12.0.6"}, {"status": "affected", "version": "8.10.0.0", "versionType": "semver", "lessThanOrEqual": "8.10.0.21"}], "defaultStatus": "affected"}]}], "published": "2026-05-12T20:16:31.683", "references": [{"url": "https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05048en_us&docLocale=en_US", "tags": ["Vendor Advisory"], "source": "security-alert@hpe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in a network management service of AOS-8 Operating System could allow an unauthenticated remote attacker to exploit this vulnerability by sending specially crafted network packets to the affected device, potentially resulting in a denial-of-service condition. Successful exploitation could cause the affected service process to terminate unexpectedly, disrupting normal device operations."}, {"lang": "es", "value": "Una vulnerabilidad en un servicio de gesti\u00f3n de red del sistema operativo AOS-8 podr\u00eda permitir a un atacante remoto no autenticado explotar esta vulnerabilidad enviando paquetes de red especialmente dise\u00f1ados al dispositivo afectado, lo que podr\u00eda resultar en una condici\u00f3n de denegaci\u00f3n de servicio. La explotaci\u00f3n exitosa podr\u00eda causar que el proceso del servicio afectado termine inesperadamente, interrumpiendo las operaciones normales del dispositivo."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A3310CEA-A66E-4374-91DE-5B9ACC49005E", "versionEndExcluding": "8.10.0.22", "versionStartIncluding": "6.5.4.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B106E8F-BD70-4427-8B0B-BE6A060DA43A", "versionEndExcluding": "8.12.0.7", "versionStartIncluding": "8.11.0.0"}, {"criteria": "cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CA7BD88-F241-4D60-9BA7-7409A1E435CC", "versionEndExcluding": "8.13.1.2", "versionStartIncluding": "8.13.0.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4311C56C-9E48-4695-A24C-C93FEFB6F354", "versionEndIncluding": "8.6.0.4-2.2.0.7", "versionStartIncluding": "8.6.0.4-2.2.0.0"}, {"criteria": "cpe:2.3:a:arubanetworks:sd-wan:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C7825F9F-FC5F-4C61-A67B-5034E943F8C3", "versionEndIncluding": "8.7.0.0-2.3.0.9", "versionStartIncluding": "8.7.0.0-2.3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-alert@hpe.com"}