CVE-2026-23819: AOS-10/AOS-8 Access Point XSS Vulnerability

CVE-2026-23819 Overview

CVE-2026-23819 is a stored or reflected cross-site scripting (XSS) vulnerability [CWE-79] in the web-based management interface of Hewlett Packard Enterprise (HPE) Aruba Access Points running AOS-10 and AOS-8 Instant firmware. An unauthenticated attacker on the same local network can inject arbitrary JavaScript that executes in a victim administrator's browser session. Successful exploitation allows the attacker to harvest user data and manipulate device configuration settings through the authenticated victim's context.

Critical Impact

Adjacent-network attackers can execute arbitrary JavaScript in administrator browsers, leading to credential theft and unauthorized changes to Access Point configuration.

Affected Products

• HPE Aruba Access Points running AOS-10
• HPE Aruba Access Points running AOS-8 Instant
• Web-based management interface component

Discovery Timeline

• 2026-05-12 - CVE-2026-23819 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-23819

Vulnerability Analysis

The vulnerability resides in the web-based management interface used to administer AOS-10 and AOS-8 Instant Access Points. The interface fails to properly sanitize or encode user-controllable input before rendering it in the browser. An attacker crafts input containing JavaScript payloads that the management UI later reflects or stores, leading to execution in the context of any administrator viewing the affected page.

Because exploitation requires user interaction and adjacent network access, an attacker typically needs presence on the same Layer 2 network segment as the management interface. Once a payload executes in the administrator's browser, the attacker inherits the administrator's session privileges. The scope change in the CVSS vector indicates that compromise of the browser context extends beyond the vulnerable component to affect the broader device configuration.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The management UI accepts attacker-supplied data and embeds it into responses without sufficient output encoding or contextual escaping. Both AOS-10 and AOS-8 Instant share affected code paths in their administrative web interface.

Attack Vector

The attack vector is Adjacent Network with low attack complexity and no privileges required. The attacker injects a malicious payload into a parameter that the management interface renders. A victim with administrative access must load the affected page, at which point the JavaScript runs and can issue authenticated requests to modify device settings, exfiltrate session tokens, or pivot deeper into the network.

The vulnerability mechanism is described in the HPE Security Bulletin. No public proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-23819

Indicators of Compromise

• Unexpected JavaScript content, <script> tags, or HTML event handlers appearing in Access Point management UI fields
• Administrative configuration changes that do not correlate with known change-management tickets
• Outbound HTTP requests from administrator workstations to unfamiliar domains immediately after visiting the AP management UI

Detection Strategies

• Inspect HTTP traffic to AP management interfaces for payloads containing encoded script tags, javascript: URIs, or DOM event attributes
• Review web server and application logs on the Access Points for anomalous parameter values containing HTML or JavaScript syntax
• Correlate administrator session activity with configuration change events to identify actions performed outside expected workflows

Monitoring Recommendations

• Forward Access Point management interface logs and admin session events to a centralized log platform for behavioral analysis
• Monitor adjacent network segments for unauthorized devices that could stage XSS payloads against management interfaces
• Alert on configuration changes to AP settings, especially those involving authentication, RADIUS, or VLAN parameters

How to Mitigate CVE-2026-23819

Immediate Actions Required

• Apply the firmware updates referenced in the HPE Security Bulletin for AOS-10 and AOS-8 Instant
• Restrict access to the Access Point web management interface to dedicated management VLANs and trusted administrator hosts
• Require administrators to log out of the management UI when not actively performing changes to reduce session exposure

Patch Information

HPE has published fixed firmware versions for both AOS-10 and AOS-8 Instant. Refer to the HPE Security Bulletin for the specific patched releases mapped to each affected branch and deployment model.

Workarounds

• Place AP management interfaces on an isolated management VLAN that is unreachable from user and guest networks
• Use a dedicated administrative workstation with a hardened browser profile and no general web browsing for Access Point management tasks
• Disable or limit the web-based management interface where centralized controller or cloud-based management is available as an alternative

# Configuration example
# Restrict AP management access to a dedicated management subnet (illustrative)
ip access-list session mgmt-acl
  user host <mgmt-workstation-ip> any permit
  any any any deny
!
apply access-list session mgmt-acl interface mgmt