Vulnerability · Published May 12, 2026 · Assigned by hpe
CVE-2026-23822Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service
Medium 5.3
In plain English
A medium-severity security flaw in ArubaOS (AOS) from Hewlett Packard Enterprise (HPE). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Official description
A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | ArubaOS (AOS) | 8.13.0.0 – through 8.13.1.18.12.0.0 – through 8.12.0.68.10.0.0 – through 8.10.0.21 |
Weakness: CWE-776 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H