CVE-2026-23823: AOS-10 Access Points RCE Vulnerability

CVE-2026-23823 Overview

CVE-2026-23823 is a command injection vulnerability in the command line interface (CLI) of HPE Aruba Networking Access Points running AOS-10. An authenticated remote attacker can inject operating system commands through the CLI and execute them on the underlying operating system. The vulnerability is classified under CWE-77: Improper Neutralization of Special Elements used in a Command. Only AOS-10.7.x.x and above are affected. AOS-10.4 AP and AOS-8 Instant software branches are not impacted.

Critical Impact

Authenticated attackers can execute arbitrary commands on the underlying operating system of affected Access Points, leading to full device compromise and potential pivoting into wireless network infrastructure.

Affected Products

• HPE Aruba Networking Access Points running AOS-10.7.x.x
• HPE Aruba Networking Access Points running AOS-10 versions above 10.7
• Not affected: AOS-10.4 AP branch and AOS-8 Instant software

Discovery Timeline

• 2026-05-12 - CVE-2026-23823 published to NVD
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-23823

Vulnerability Analysis

The vulnerability resides in the command line interface exposed by Access Points running AOS-10. The CLI fails to properly neutralize special elements supplied as part of command arguments, allowing an attacker who has authenticated to the device to break out of the intended command context. Crafted CLI input is passed to the underlying operating system shell, where injected commands execute with the privileges of the CLI process.

Successful exploitation yields arbitrary command execution on the access point operating system. An attacker can read configuration data, modify wireless settings, extract credentials, capture client traffic, or use the compromised AP as a foothold for lateral movement into management networks.

The issue carries an EPSS probability of 0.188% (percentile 40.382) as of 2026-05-17, indicating low predicted exploitation activity. However, the impact remains significant because access points commonly bridge trusted internal networks.

Root Cause

The root cause is improper neutralization of shell metacharacters in CLI command handlers. User-supplied arguments are concatenated into system command strings without sufficient sanitization or use of safe execution APIs. This pattern is the defining characteristic of CWE-77 command injection.

Attack Vector

The attack vector is network-based and requires high privileges, meaning the attacker must already hold valid administrative or operator credentials to reach the CLI. From an authenticated session, the attacker submits a CLI command containing shell control characters or chained command separators. The injected payload is interpreted by the underlying shell rather than being treated as literal argument data. No user interaction is required. See the HPE Security Notice for vendor technical details.

Detection Methods for CVE-2026-23823

Indicators of Compromise

• Unexpected child processes spawned by the CLI service on AOS-10 access points
• CLI command history entries containing shell metacharacters such as ;, |, &&, `, or $()
• Outbound network connections from access points to unusual external hosts
• Configuration changes or new administrative accounts created outside change windows

Detection Strategies

• Forward AOS-10 syslog and AAA authentication logs to a central SIEM and alert on command strings containing shell injection patterns
• Monitor for repeated CLI sessions from a single source followed by anomalous configuration commits
• Correlate administrative logins with subsequent network behavior changes on the AP, such as new packet captures or tunnels

Monitoring Recommendations

• Enable verbose CLI command auditing on all AOS-10.7.x.x and later access points
• Restrict CLI management access to dedicated jump hosts and monitor those hosts for unusual outbound activity
• Review privileged account usage on Aruba Central and on-premises controllers for unexpected session origins

How to Mitigate CVE-2026-23823

Immediate Actions Required

• Identify all access points running AOS-10.7.x.x or above and inventory them as in-scope for this advisory
• Apply the fixed AOS-10 firmware version published in the HPE Security Notice
• Rotate administrative credentials for any device suspected of unauthorized access
• Restrict management plane access to trusted management VLANs only

Patch Information

HPE has published a security notice with fixed software versions for AOS-10 access points. Refer to the HPE Security Notice (hpesbnw05049en_us) for the specific patched releases and upgrade paths. AOS-10.4 AP and AOS-8 Instant branches do not require patching for this CVE.

Workarounds

• Limit CLI access to a small set of named administrative accounts and enforce strong authentication
• Place AP management interfaces on an isolated VLAN reachable only from authorized administrative hosts
• Disable remote CLI access where centralized management through Aruba Central or controllers is sufficient
• Audit and remove unused or shared operator accounts on affected access points

# Example: restrict AP management access at the network layer
# Permit only the management subnet to reach the AP CLI (SSH)
access-list ip MGMT-ONLY
  10 permit tcp 10.10.0.0 0.0.0.255 any eq 22
  20 deny   tcp any any eq 22
  30 permit ip any any

interface vlan 99
  ip access-group MGMT-ONLY in