CVE-2026-23825
published 2026-05-12CVE-2026-23825: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.33%
24.7th percentile
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| arubanetworks | arubaos | >= 10.4.0.0 < 10.4.1.11 | 10.4.1.11 |
| arubanetworks | arubaos | >= 10.5.0.0 < 10.7.2.3 | 10.7.2.3 |
| arubanetworks | arubaos | >= 6.5.4.0 < 8.10.0.22 | 8.10.0.22 |
| arubanetworks | arubaos | >= 8.11.0.0 < 8.12.0.7 | 8.12.0.7 |
| arubanetworks | arubaos | >= 8.13.0.0 < 8.13.1.2 | 8.13.1.2 |
| arubanetworks | sd-wan | 8.6.0.4-2.2.0.0 – 8.6.0.4-2.2.0.7 | — |
| arubanetworks | sd-wan | 8.7.0.0-2.3.0.0 – 8.7.0.0-2.3.0.9 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | — | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.4.0.0 – 10.4.1.10 | — |
| hewlett_packard_enterprise | hpe_aruba_networking_wireless_operating_system | 10.7.0.0 – 10.7.2.2 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
HPE Aruba Networking Wireless Operating System up to 10.4.1.10/10.7.2.2/10.8.0.0 Affected Service denial of service
vuldb·2026-05-12
CVE-2026-23825 [CRITICAL] HPE Aruba Networking Wireless Operating System up to 10.4.1.10/10.7.2.2/10.8.0.0 Affected Service denial of service
A vulnerability described as problematic has been identified in HPE Aruba Networking Wireless Operating System up to 10.4.1.10/10.7.2.2/10.8.0.0. The impacted element is an unknown function of the component Affected Service. Such manipulation leads to denial of service.
This vulnerability is documented as CVE-2026-23825. The attack can be executed remotely. There is not any exploit available.
GHSA
GHSA-6267-3wmp-x754: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems
ghsa_unreviewed·2026-05-12
CVE-2026-23825 [HIGH] CWE-20 GHSA-6267-3wmp-x754: Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-05-12
Published