CVE-2026-23813CWE-287

CVE-2026-23813

Critical · published March 11, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
55.0
In the wild
Unconfirmed
What it is

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00765 · 55.0th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-03-11T08:17Z
Affected products (4)
ProductVersionsFixed in
hpe/arubaos-cx< 10.10.118010.10.1180
hpe/arubaos-cx≥ 10.13.0000, < 10.13.116110.13.1161
hpe/arubaos-cx≥ 10.16.0000, < 10.16.103010.16.1030
hpe/arubaos-cx≥ 10.17.0000, < 10.17.100110.17.1001
References (1)
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05027en_us&docLocale=en_US · [email protected]
EPSS history
Timeline
  • 11 MAR 03:08Z
    Authentication Bypass in Web Interface allows Unauthenticated Admin Password Reset
    cvelistv5