Vulnerability · Published Apr 7, 2026 · Assigned by hpe
CVE-2026-23818Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem
High 8.8
In plain English
A high-severity open redirect in Private 5G Core from Hewlett Packard Enterprise (HPE). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may redirect an authenticated user to an attacker-controlled server hosting a spoofed login page prompting the unsuspecting victim to give away their credentials, which could then be captured by the attacker, before being redirected back to the legitimate login page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | Private 5G Core | 1.0.0.0 – through 1.25.3.0 |
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H