Medium severity · published Feb 17, 2026
CVE-2026-23598
Unauthenticated Information Disclosure in application API allows sensitive system information exposure
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HPE Aruba Networking Private 5G Core · Hewlett Packard Enterprise (HPE)
1.24.3.0 through 1.24.3.4 · source: vendor
AN
Aruba Networking Private 5g Core · Hpe
1.24.3.0 through 1.24.3.3 · source: NVD
Affected product
HA
HPE Aruba Networking Private 5G Core
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23598
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23598
Patch
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05002en_us&docLocale=en_US
More from HPE Aruba Networking Private 5G Core
8.8
CVE-2026-23595
Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation
7.7
CVE-2025-37100
Exposure of Sensitive Information to an Unauthorized User in HPE Aruba Networking Private 5G Core
6.5
CVE-2026-23597
Unauthenticated Information Disclosure in application API allows sensitive system information exposure
6.5
CVE-2026-23596
Unauthenticated Improper Access Control in management API allows unauthorized service disruption
