Critical 9.8 CVSS Bypass Unearthed in HPE Aruba AOS-CX Switches

HPE Aruba Networking has officially released software patches for its AOS-CX platform to address a series of security vulnerabilities, ranging from medium to critical severity. The flaws impact several major software branches, potentially exposing enterprise switches to unauthorized access and command injection.

The most severe issue identified is a critical Authentication Bypass (CVE-2026-23813) found in the web interface, sporting a near-perfect CVSS score of 9.8.

According to the security bulletin: “A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password”.

This bypass effectively hands the keys to the kingdom to any remote actor with network access to the management interface, making immediate remediation a top priority for network security teams

Beyond the critical bypass, the bulletin details multiple Command Injection vulnerabilities (CVE-2026-23814, CVE-2026-23815, and CVE-2026-23816). These flaws vary in their requirements—some require low-privilege authentication, while others require high-level administrative access—but all could lead to significant “unwanted behavior” or the execution of “arbitrary commands on the underlying operating system”.

Additionally, a medium-severity Open Redirect (CVE-2026-23817) was discovered, which could be used in URL manipulation to trick users into visiting malicious sites.

The vulnerabilities impact several active AOS-CX branches. Organizations should check their current inventory against the following list of affected versions:

Branch	Affected Versions	Recommended Patch
AOS-CX 10.17.xxxx	10.17.0001 and below	10.17.1001 and above
AOS-CX 10.16.xxxx	10.16.1020 and below	10.16.1030 and above
AOS-CX 10.13.xxxx	10.13.1160 and below	10.13.1161 and above
AOS-CX 10.10.xxxx	10.10.1170 and below	10.10.1180 and above

While patching is the only permanent fix, HPE Aruba Networking suggests several workarounds to reduce risk. Key recommendations include:

• Network Isolation: Restrict management interface access to a dedicated Layer 2 segment or VLAN.
• Access Control: Implement strict Layer 3 policies and use Control Plane ACLs to ensure only trusted hosts can connect to HTTPS/REST endpoints.
• Interface Management: Disable HTTP(S) interfaces on ports where management access is not strictly required.
• Monitoring: Enable comprehensive logging and accounting to detect unauthorized access attempts in real-time.