CVE-2026-23601

Frame Injection via Shared GTK Allows Traffic Spoofing and Client Compromise

A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2026-23808

Client Isolation Bypass via GTK Manipulation

A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2026-23809

MAC Address Spoofing leads to Inter-BSSID Isolation Bypass Resulting in Traffic Redirection

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2026-23811

Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation

A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2026-23810

Cross-BSSID GTK Re-encryption and Traffic Injection

A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causes an Access Point (AP) to classify the frame as group-addressed traffic and re-encrypt it using the Group Temporal Key (GTK) associated with the victim's BSSID. Successful exploitation may enable GTK-independent traffic injection and, when combined with a port-stealing technique, allows an attacker to redirect intercepted traffic to facilitate machine-in-the-middle (MitM) attacks across BSSID boundaries.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2026-23812

Security Boundary Bypass via Routing Node Impersonation

A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks Hpe

Products

7010 7030 7205 and 16 more

CVE-2023-22762

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22767

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22766

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22765

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22764

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22763

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22776

Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read

An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22774

Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.

Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22773

Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion.

Authenticated path traversal vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to delete arbitrary files in the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22768

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22769

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22770

Authenticated Remote Command Execution in the ArubaOS Command Line Interface

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-22771

Insufficient Session Expiration in ArubaOS Command Line Interface

An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

7010 7030 7205 and 21 more

CVE-2023-38486

Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways

A vulnerability in the secure boot implementation on affected Aruba 9200 and 9000 Series Controllers and Gateways allows an attacker to bypass security controls which would normally prohibit unsigned kernel images from executing. An attacker can use this vulnerability to execute arbitrary runtime operating systems, including unverified and unsigned OS images.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Arubanetworks

Products

9004 9004-lte 9012 and 2 more