CVE-2026-23822mediumCWE-776

CVE-2026-23822: falha de média gravidade em Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

Unauthenticated XML External Entity Injection in AOS-8 Instant allows Denial of Service

Publicada em

Seguir esta CVE+ Monitorar ArubaOS

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Produtos afetados
Hewlett Packard Enterprise (HPE) · ArubaOS (AOS)
CVEs relacionadas — Hewlett Packard Enterprise (HPE) ArubaOS (AOS)

No mesmo produto, das mais perigosas para as menos.

CVE-2026-79861CRITICALUnauthenticated Command Injection Vulnerability in the PAPI Protocol of AOS-10EPSS 1.7%CVE-2026-79846CRITICALUnauthenticated Command Injection Vulnerabilities in AOS-8EPSS 1.6%CVE-2026-95715MEDIUMUnauthenticated Local Command Injection Vulnerability in AOS-10 Command Line InterfaceEPSS 1.6%CVE-2026-79864CRITICALUnauthenticated Adjacent Command Injection Vulnerability in AOS-10EPSS 1.5%CVE-2025-37176MEDIUMAuthenticated Command Injection Vulnerability in an AOS-8 operating system's internal workflowEPSS 1.4%CVE-2026-79857CRITICALUnauthenticated Command Injection Vulnerability in AOS-8 PAPI ProtocolEPSS 1.4%