CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23819: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to...

PT-2025-15460 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant affected versions not specified AOS-10 AP versions up to 8.10.0.15 AOS-10 AP versions up to 8.12.0.3 AOS-10 AP versions up to 10.4.1.5 AOS-10 AP versions up to 10.7.0.1 Description: A vulnerability in a system binary could allow...

PT-2025-15461 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant versions prior to the fixed version AOS-10 AP versions prior to the fixed version Description: A vulnerability in the file creation process on the command line interface could allow an authenticated remote attacker to perform...