CVE-2026-23820: Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

High severity · published May 12, 2026

CVE-2026-23820

Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

7.2

CVSS

0.6%

EPSS

On KEV

Description

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 46% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

ArubaOS (AOS) · Hewlett Packard Enterprise (HPE)

10.8.0.0; 10.7.0.0 through 10.7.2.2; 10.4.0.0 through 10.4.1.10; 8.13.0.0 through 8.13.1.1; 8.12.0.0 through 8.12.0.6; 8.10.0.0 through 8.10.0.21 · source: vendor

Arubaos · Arubanetworks

6.4.0.0 through 6.5.4.24; 8.4.0.0 before 8.10.0.22; 8.11.0.0 before 8.12.0.7; 8.13.0.0 before 8.13.1.2; 10.3.0.0 before 10.4.1.11; 10.5.0.0 before 10.7.2.3; +1 more · source: NVD

Affected product

ArubaOS (AOS)

Hewlett Packard Enterprise (HPE)

All ArubaOS (AOS) CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-23820

CVE.org

https://www.cve.org/CVERecord?id=CVE-2026-23820

Vendor Advisory

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05049en_us&docLocale=en_US