Quick answers
- Is CVE-2026-23819 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-23819 being exploited in the wild.
- How severe is CVE-2026-23819?
- High severity, with a CVSS score of 8.8, published 12 May 2026.
- Which products and versions are affected?
- HPE Aruba Networking AOS-10; HPE Aruba Networking AOS-8 Instant.
- Is there a fix for CVE-2026-23819?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-23819 attacked?
- It is attacked from the adjacent network, in an operating system.
- Am I affected by CVE-2026-23819?
- Check whether you run HPE Aruba Networking AOS-10 or HPE Aruba Networking AOS-8 Instant. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability classified as Improper Neutralization of Input During Web Page Generation (CWE-79), or Cross-Site Scripting (XSS), exists in the web-based management interface of Aruba Access Points. The flaw affects devices running AOS-10 and AOS-8 Instant. An unauthenticated attacker located on the same local network (Adjacent vector) can exploit this by inducing a user to interact with a malicious link or page. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session, potentially leading to session hijacking, data exfiltration, or unauthorized modification of device settings. The CVSS score of 8.8 reflects the high impact on confidentiality, integrity, and availability due to the 'Scope: Changed' (S:C) metric common in XSS attacks.
Affected products
- HPE Aruba Networking AOS-10
- HPE Aruba Networking AOS-8 Instant
Timeline
- 2026-05-12: advisory: Initial disclosure by HPE/Aruba