CVE-2026-23822: AOS-8 DHCP Services DoS Vulnerability

CVE-2026-23822 Overview

CVE-2026-23822 is a denial-of-service vulnerability in the XML handling component of Aruba Operating System (AOS-8) DHCP services. An unauthenticated remote attacker can trigger excessive resource consumption on affected Access Points, leading to service disruption or reduced system availability. The flaw is classified under CWE-776 (Improper Restriction of Recursive Entity References in DTDs, also known as XML Entity Expansion). Exploitation requires user interaction and depends on conditions that increase attack complexity. The vulnerability impacts only Access Points running AOS Instant 8.x.x.x. HPE Aruba Networking has published an advisory addressing the issue.

Critical Impact
A successful attack consumes Access Point resources and disrupts DHCP services, affecting wireless client connectivity across the impacted network segment.

Affected Products

HPE Aruba Networking Access Points running AOS Instant 8.x.x.x
AOS-8 DHCP service XML handling component
Wireless deployments dependent on Instant AP DHCP services

Discovery Timeline

2026-05-12 - CVE-2026-23822 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-23822

Vulnerability Analysis

The vulnerability resides in how AOS-8 DHCP services parse XML input. The XML handler fails to restrict recursive or expansive entity references, allowing crafted input to consume disproportionate CPU and memory. This pattern aligns with the XML Entity Expansion class of attacks tracked under CWE-776.

The attack reaches the service over the network without authentication. However, the exploit chain requires user interaction and benefits from specific environmental conditions, which raises attack complexity. When triggered, the parser exhausts resources allocated to the DHCP service. This degrades or halts DHCP processing on the Access Point.

The impact is limited to availability. Confidentiality and integrity of data on the device remain unaffected. Wireless clients dependent on the affected Access Point for address assignment lose connectivity until the service recovers or the device is restarted.

Root Cause

The root cause is insufficient validation of XML entity expansion within the DHCP service's XML parser. The parser processes nested or recursive entity definitions without enforcing depth, size, or expansion limits. This produces an algorithmic complexity condition that an attacker can weaponize with a small, crafted payload.

Attack Vector

An unauthenticated attacker delivers a malicious XML payload to the AOS-8 DHCP service over the network. The attack requires user interaction, which differentiates it from fully remote, zero-interaction denial-of-service flaws. Once parsed, the payload triggers runaway entity expansion, consuming Access Point resources and disrupting DHCP responses.

No verified public proof-of-concept exists. Refer to the HPE Support Document for vendor-supplied technical details.

Detection Methods for CVE-2026-23822

Indicators of Compromise

Sudden spikes in CPU or memory utilization on AOS Instant 8.x.x.x Access Points coinciding with DHCP traffic
DHCP service crashes, restarts, or unresponsive lease assignment on affected devices
Wireless clients failing to obtain or renew IP addresses across a single AP or AP cluster
Unusual XML-formatted payloads observed in DHCP-adjacent traffic captures

Detection Strategies

Monitor AOS-8 syslog and SNMP traps for DHCP service errors, parser exceptions, and resource alarms
Inspect network telemetry for malformed or oversized XML payloads directed at Access Point management interfaces
Correlate AP resource exhaustion events with downstream client DHCP failures in centralized logging

Monitoring Recommendations

Forward Access Point logs to a centralized SIEM or data lake for correlation across the wireless fleet
Establish baselines for AP CPU, memory, and DHCP response latency to surface anomalies quickly
Alert on repeated DHCP service restarts on the same device within short time windows

How to Mitigate CVE-2026-23822

Immediate Actions Required

Identify all Access Points running AOS Instant 8.x.x.x and inventory current firmware versions
Apply the firmware update referenced in the HPE Aruba Networking advisory
Restrict management and DHCP service exposure to trusted administrative networks only
Review wireless segmentation to limit the blast radius of a disrupted Access Point

Patch Information

HPE Aruba Networking has issued a security bulletin with fixed firmware versions for AOS Instant 8.x.x.x. Consult the HPE Support Document for the specific patched releases and upgrade procedures. Apply the update during a planned maintenance window because Access Point upgrades disrupt wireless service.

Workarounds

Place Access Point management interfaces on a dedicated, access-controlled VLAN
Apply ACLs restricting which sources can reach AP DHCP and management services
Migrate eligible deployments to a supported AOS branch where feasible

bash

# Example ACL concept restricting AP management access to trusted subnets
ip access-list session restrict-ap-mgmt
  user host <trusted-mgmt-subnet> any permit
  user any any deny