CVE-2026-23821
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under cer…
Published May 12, 2026 · updated Aug 12, 2026 · arubanetworks arubaos
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
May 12, 2026 · NIST NVD
Detected
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability
Aug 12, 2026 · NIST NVD
Updated
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability
Affected
- cpe arubanetworks/arubaosversion unspecified
- cpe arubanetworks/arubaos10.8.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-23821
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-23821
A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on th
nvd.nist.gov