← Vulnerability feed

Vulnerability record · CVE-2026-23815 · published 11 March 2026

CVE-2026-23815: Hpe arubaos-cx command injection vulnerability

Hpe · Arubaos Cx

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.

7.2 CVSS 3.1 High EPSS 0.94% · top 40.7% CWE-77 · Command injection
7.2CVSS 3.1 base score
0.94%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
1References
22 Sep 2026Last modified by NVD

Description

A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute unauthorized commands.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05027en_us&docLocale=en_US Vendor AdvisoryMitigation

Track CVE-2026-23815 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2026-73778Hpe arubaos-cx weak password requirements vulnerabilityA vulnerability exists in the Credential Manager component that may allow for unauthorized administrative access. An unauthenticated remote attacker …EPSS 0.51%9.8CVE-2026-73749Hpe arubaos-cx improper access control vulnerabilityMultiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker co…EPSS 0.82%9.8CVE-2026-23813Hpe arubaos-cx improper authentication vulnerabilityA vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote a…EPSS 0.74%8.8CVE-2026-73782Hpe arubaos-cx vulnerabilityA format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Successful exp…EPSS 0.42%8.8CVE-2026-73763Hpe arubaos-cx command injection vulnerabilityA vulnerability exists in a management component that could allow an unauthenticated adjacent attacker to execute arbitrary commands. Successful expl…EPSS 0.48%8.8CVE-2026-73750Hpe arubaos-cx improper access control vulnerabilityVulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could e…EPSS 0.80%8.8CVE-2026-73751Hpe arubaos-cx command injection vulnerabilityAn authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands …EPSS 0.66%8.8CVE-2026-73752Hpe arubaos-cx path traversal vulnerabilityAn unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an at…EPSS 0.47%

Source: NIST National Vulnerability Database (record CVE-2026-23815), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.