How severe is CVE-2026-23808?

CVE-2026-23808 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-23808 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-23808?

CVE-2026-23808 primarily affects Arubanetworks Arubaos. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-23808?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-23808 have an EU (EUVD) identifier?

Yes. CVE-2026-23808 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9414.

When was CVE-2026-23808 published?

CVE-2026-23808 was published on 2026-03-04 and last updated on 2026-06-17.

CVE-2026-23808

CVE-2026-23808 is a medium-severity vulnerability in Arubanetworks Arubaos with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-94.

Key facts

Severity: Medium (CVSS 3.x base score 5.4)
EPSS exploit prediction: 0% (19th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-9414
Weakness: CWE-94
Affected product: Arubanetworks Arubaos
Published: 2026-03-04
Last modified: 2026-06-17

Description

A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.

Frequently asked questions

What is CVE-2026-23808?: A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.
How severe is CVE-2026-23808?: CVE-2026-23808 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-23808 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (19th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-23808?: CVE-2026-23808 primarily affects Arubanetworks Arubaos. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-23808?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-23808 have an EU (EUVD) identifier?: Yes. CVE-2026-23808 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-9414.
When was CVE-2026-23808 published?: CVE-2026-23808 was published on 2026-03-04 and last updated on 2026-06-17.

References

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US

Affected products (2)

cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*

More vulnerabilities in Arubanetworks Arubaos

CVE-2008-7023 — Critical (CVSS 10.0): Aruba Mobility Controller running ArubaOS 3.3.1.16, and possibly other versions, installs the same default X.509…
CVE-2024-42395 — Critical (CVSS 9.8): There is a vulnerability in the AP Certificate Management Service which could allow a threat actor to execute an…
CVE-2024-42394 — Critical (CVSS 9.8): There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated…
CVE-2024-42393 — Critical (CVSS 9.8): There are vulnerabilities in the Soft AP Daemon Service which could allow a threat actor to execute an unauthenticated…
CVE-2024-31473 — Critical (CVSS 9.8): There is a command injection vulnerability in the underlying deauthentication service that could lead to…
CVE-2024-31472 — Critical (CVSS 9.8): There are command injection vulnerabilities in the underlying Soft AP Daemon service that could lead to unauthenticated…

All CVEs affecting Arubanetworks Arubaos →

Other CWE-94 (Code Injection) vulnerabilities

CVE-2026-76605 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.3 - ???.
CVE-2026-76604 — Critical (CVSS 10.0): Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.3 - The…
CVE-2026-67364 — Critical (CVSS 10.0): Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1:…
CVE-2026-73343 — Critical (CVSS 10.0): Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-74253 — Critical (CVSS 10.0): Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0…
CVE-2026-73678 — Critical (CVSS 10.0): MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that…

Browse all CWE-94 (Code Injection) vulnerabilities →