Review reviewHigh

CVE-2026-23819

Hewlett Packard Enterprise (HPE) ArubaOS (AOS), arubaos

A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

CVSS: 8.8
EPSS: 0.27%
CISA KEV: Not listed
Published: 2026.05.13

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability0.27%

Technical severityCVSS 8.8

Vulnerability overview

Affected product and versions

Product: Hewlett Packard Enterprise (HPE) ArubaOS (AOS), arubaos
Affected versions: >= 10.8.0.0, >= 10.7.0.0 <= 10.7.2.2, >= 10.4.0.0 <= 10.4.1.10, >= 8.13.0.0 <= 8.13.1.1, >= 8.12.0.0 <= 8.12.0.6, >= 8.10.0.0 <= 8.10.0.21, >= 6.4.0.0 <= 6.5.4.24, >= 8.4.0.0 < 8.10.0.22, >= 8.11.0.0 < 8.12.0.7, >= 8.13.0.0 < 8.13.1.2, >= 10.3.0.0 < 10.4.1.11, >= 10.5.0.0 < 10.7.2.3, 10.8.0.0
Fixed versions: 8.10.0.22, 8.12.0.7, 8.13.1.2, 10.4.1.11, 10.7.2.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Hewlett Packard Enterprise (HPE) ArubaOS (AOS), arubaos and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE: CWE-79