A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate a gateway by leveraging an address-based spoofing technique. Successful exploitation enables the redirection of data streams, allowing for the interception or modification of traffic intended for the legitimate network gateway via a Machine-in-the-Middle (MitM) position.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aruba Aos 10 | — | Upgrade Mobility Conductors, Controllers, Gateways, and Access Points to one of the following AOS-10 or AOS-8 versions (as applicable) to resolve the vulnerabilities described in the details section:
- AOS-10.8.x.x: 10.8.0.1 and above
- AOS-10.7.x.x: 10.7.2.3 and above
- AOS-10.4.x.x: 10.4.1.11 and above
- AOS-8.13.x.x: 8.13.1.2 and above
- AOS-8.12.x.x: 8.12.0.7 and above
- AOS-8.10.x.x: 8.10.0.22 and above(*)
(*) Fix for the CVE-2026-23812 specifically will be included in AOS-8.10.0.23. Please refer to the CVE-2026-23812 vulnerability description noted above for more details.
Software versions with resolution/fixes for the vulnerabilities covered above can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/globalsearch#tab=Software
HPE Aruba Networking does not evaluate or patch AOS-10 and AOS-8 software branches that have reached their End of Maintenance (EoM) milestone. For more information about HPE Aruba Networking's End of Life policy visit: https://www.hpe.com/psnow/doc/a00143052enw. | Mar 16, 2026 | Mar 3, 2026 |
| Aruba Aos 8 | — | Upgrade Mobility Conductors, Controllers, Gateways, and Access Points to one of the following AOS-10 or AOS-8 versions (as applicable) to resolve the vulnerabilities described in the details section:
- AOS-10.8.x.x: 10.8.0.1 and above
- AOS-10.7.x.x: 10.7.2.3 and above
- AOS-10.4.x.x: 10.4.1.11 and above
- AOS-8.13.x.x: 8.13.1.2 and above
- AOS-8.12.x.x: 8.12.0.7 and above
- AOS-8.10.x.x: 8.10.0.22 and above(*)
(*) Fix for the CVE-2026-23812 specifically will be included in AOS-8.10.0.23. Please refer to the CVE-2026-23812 vulnerability description noted above for more details.
Software versions with resolution/fixes for the vulnerabilities covered above can be downloaded from the HPE Networking Support Portal at https://networkingsupport.hpe.com/globalsearch#tab=Software
HPE Aruba Networking does not evaluate or patch AOS-10 and AOS-8 software branches that have reached their End of Maintenance (EoM) milestone. For more information about HPE Aruba Networking's End of Life policy visit: https://www.hpe.com/psnow/doc/a00143052enw. | Mar 16, 2026 | Mar 3, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub