A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Aos 10 | — | To address the vulnerabilities described above in the affected software branches, upgrade HPE Aruba Networking AOS-10 AP and AOS-8 Instant software to one of the following versions (as applicable):
- AOS-10 AP 10.8.x.x: 10.8.0.1 and above
- AOS-10 AP 10.7.x.x: 10.7.2.3 and above
- AOS-10 AP 10.4.x.x: 10.4.1.11 and above
- AOS-8 Instant 8.13.x.x: 8.13.1.2 and above
- AOS-8 Instant 8.12.x.x: 8.12.0.7 and above
- AOS-8 Instant 8.10.x.x: 8.10.0.22 and above | May 13, 2026 | May 12, 2026 |
| Aruba Aos 8 | — | To address the vulnerabilities described above in the affected software branches, upgrade HPE Aruba Networking AOS-10 AP and AOS-8 Instant software to one of the following versions (as applicable):
- AOS-10 AP 10.8.x.x: 10.8.0.1 and above
- AOS-10 AP 10.7.x.x: 10.7.2.3 and above
- AOS-10 AP 10.4.x.x: 10.4.1.11 and above
- AOS-8 Instant 8.13.x.x: 8.13.1.2 and above
- AOS-8 Instant 8.12.x.x: 8.12.0.7 and above
- AOS-8 Instant 8.10.x.x: 8.10.0.22 and above | May 13, 2026 | May 12, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub