Vulnerability · Published May 12, 2026 · Assigned by hpe
CVE-2026-23825Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component
High 7.5
In plain English
A high-severity improper input validation in HPE Aruba Networking Wireless Operating System (AOS) from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).
Official description
Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Aruba Networking Wireless Operating System (AOS) | 10.8.0.010.7.0.0 – through 10.7.2.210.4.0.0 – through 10.4.1.10 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H