Log in Start free

Vulnerability · Published May 12, 2026 · Assigned by hpe

CVE-2026-23819Error in SSID Processing allows Stored XSS in Web Management Interface

High 8.8

In plain English

A high-severity cross-site scripting in ArubaOS (AOS) from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 80.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

Affected products (as reported)

VendorProductVersions
Hewlett Packard Enterprise (HPE) ArubaOS (AOS) 10.8.0.010.7.0.0 – through 10.7.2.210.4.0.0 – through 10.4.1.108.13.0.0 – through 8.13.1.18.12.0.0 – through 8.12.0.68.10.0.0 – through 8.10.0.21

Weakness: CWE-79 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References