A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbit…

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. May 12, 2026 · NIST NVD

   Detected

   A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

2. Aug 11, 2026 · NIST NVD

   Updated

   A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.

Affected

• cpe arubanetworks/arubaosversion unspecified
• cpe arubanetworks/arubaos10.8.0.0

Sources

• CVE.orgVulnerability recordCVE-2026-23819

  Official CVE identifier

  cve.org
• NIST NVDVulnerability recordCVE-2026-23819

  A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an

  nvd.nist.gov

References

• Vendor Advisory · support.hpe.com