CVE-2026-23813
critical · 9.8A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.
9.8
CVSS
0.7%
EPSS (exploit prob.)
53rd
EPSS percentile
2026-03-11
Published
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| hpe | arubaos-cx | <= 10.10.1170 |
| hpe | arubaos-cx | >= 10.13.0000, <= 10.13.1160 |
| hpe | arubaos-cx | >= 10.16.0000, <= 10.16.1020 |
| hpe | arubaos-cx | >= 10.17.0000, <= 10.17.0001 |
| hpe | aruba_cx_10000-48y6c_(r8p13a) | all versions |
| hpe | aruba_cx_10000-48y6c_(r8p14a) | all versions |
| hpe | aruba_cx_10000-48y6c_(s0f98a) | all versions |
| hpe | aruba_cx_10040_(s4r58a) | all versions |
| hpe | aruba_cx_10040_32p_(s4r54a) | all versions |
| hpe | aruba_cx_10040_32p_(s4r55a) | all versions |
| hpe | aruba_cx_10040_32p_(s4r56a) | all versions |
| hpe | aruba_cx_4100i_12-port_(jl817a) | all versions |
| hpe | aruba_cx_4100i_24-port_(jl818a) | all versions |
| hpe | aruba_cx_6000_12g_(r8n89a) | all versions |
| hpe | aruba_cx_6000_12p_(r8n89b) | all versions |
| hpe | aruba_cx_6000_12p_(s4r21a) | all versions |
| hpe | aruba_cx_6000_24g_(r8n87a) | all versions |
| hpe | aruba_cx_6000_24g_(r8n88a) | all versions |
| hpe | aruba_cx_6000_24p_(r8n87b) | all versions |
| hpe | aruba_cx_6000_24p_(r8n88b) | all versions |
| hpe | aruba_cx_6000_24p_(s4r26a) | all versions |
| hpe | aruba_cx_6000_24p_(s4r27a) | all versions |
| hpe | aruba_cx_6000_48g_(r8n85a) | all versions |
| hpe | aruba_cx_6000_48g_(r8n86a) | all versions |
| hpe | aruba_cx_6000_48g_(r9y03a) | all versions |
| hpe | aruba_cx_6000_48p_(r8n85b) | all versions |
| hpe | aruba_cx_6000_48p_(r8n86b) | all versions |
| hpe | aruba_cx_6000_48p_(r9y03b) | all versions |
| hpe | aruba_cx_6000_48p_(s4r20a) | all versions |
| hpe | aruba_cx_6000_48p_(s4r24a) | all versions |
| hpe | aruba_cx_6000_48p_(s4r25a) | all versions |
| hpe | aruba_cx_6000_8p_(s4r22a) | all versions |
| hpe | aruba_cx_6000_8p_(s4r23a) | all versions |
| hpe | aruba_cx_6000_8p_(s4r28a) | all versions |
| hpe | aruba_cx_6000_8p_(s4r29a) | all versions |
| hpe | aruba_cx_6100_12g_(jl679a) | all versions |
| hpe | aruba_cx_6100_24g_(jl677a) | all versions |
| hpe | aruba_cx_6100_24g_(jl678a) | all versions |
| hpe | aruba_cx_6100_48g_(jl675a) | all versions |
| hpe | aruba_cx_6100_48g_(jl676a) | all versions |
Check a specific version with /api/v1/cve/match.
References
Query this programmatically:
curl https://evil-db.io/api/v1/cve/CVE-2026-23813