CVE-2026-23816CWE-78command-injection

CVE-2026-23816

High · published March 11, 2026

CVSS v3.1

7.2

EPSS

Percentile

68.6

In the wild

Unconfirmed

What it is

A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

The record

Technical detail

CVSS v3.1: 7.2 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.01227 · 68.6th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2026-03-11T08:17Z

Affected products (4)

Product	Versions	Fixed in
hpe/arubaos-cx	< 10.10.1180	10.10.1180
hpe/arubaos-cx	≥ 10.13.0000, < 10.13.1161	10.13.1161
hpe/arubaos-cx	≥ 10.16.0000, < 10.16.1030	10.16.1030
hpe/arubaos-cx	≥ 10.17.0000, < 10.17.1001	10.17.1001

References (1)

https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05027en_us&docLocale=en_US · [email protected]

EPSS history

Timeline

11 MAR 03:13Z
Authenticated Command Injection found in admin AOS-CX CLI command
cvelistv5