Vulnerability · Published Feb 17, 2026 · Assigned by hpe
CVE-2026-23596Unauthenticated Improper Access Control in management API allows unauthorized service disruption
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in HPE Aruba Networking Private 5G Core from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 81.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Private 5G Core | 1.24.3.0 – through 1.24.3.4 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H