CVE-2026-23809

published 2026-03-04

CVE-2026-23809: A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between…

Priority P3 38 high 7.6 CVSS 3.1

AV A AC L PR N UI N S U C L I L A H

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
arubanetworks	arubaos	—	—
arubanetworks	arubaos	10.3.0.0 – 10.4.1.10	—
arubanetworks	arubaos	10.5.0.0 – 10.7.2.2	—
arubanetworks	arubaos	6.5.4.0 – 8.10.0.21	—
arubanetworks	arubaos	8.11.0.0 – 8.12.0.6	—
arubanetworks	arubaos	8.13.0.0 – 8.13.1.1	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	—	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	10.4.0.0 – 10.4.1.10	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	10.7.0.0 – 10.7.2.2	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	8.10.0.0 – 8.10.0.21	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	8.12.0.0 – 8.12.0.6	—
hewlett_packard_enterprise	hpe_aruba_networking_wireless_operating_system	8.13.0.0 – 8.13.1.1	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-400