CVE-2026-23813
CRITICAL WAF: Low
CVSS 9.8
Published: 2026-03-11
CWE-287
A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.
WAF Coverage Analysis
Improper Authentication
Low WAF Coverage
OWASP: A07:2021 Identification and Authentication Failures
Affected Software
| Vendor | Product | Version |
|---|---|---|
| hpe | arubaos-cx | up to 10.10.1180 |
| hpe | arubaos-cx | 10.13.0000 - 10.13.1161 |
| hpe | arubaos-cx | 10.16.0000 - 10.16.1030 |
| hpe | arubaos-cx | 10.17.0000 - 10.17.1001 |
References
- support.hpe.com (Vendor Advisory, Mitigation)