CVE-2026-23820 Inconsistent input filtering allows Authenticated Command Injection in AOS-8 Instant and AOS-10 CLI

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23820: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlyin...

CVE-2026-23819: Improper Neutralization of Input During Web Page Generation

A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to...

CVE-2025-37148: Uncontrolled Resource Consumption

A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to potentially disrupt network services and require manual intervention to restore...

PT-2025-15460 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant affected versions not specified AOS-10 AP versions up to 8.10.0.15 AOS-10 AP versions up to 8.12.0.3 AOS-10 AP versions up to 10.4.1.5 AOS-10 AP versions up to 10.7.0.1 Description: A vulnerability in a system binary could allow...

CVE-2025-27079: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perform remote code execution RCE. Successful exploitation could allow an attacker to execute arbitrary operating system commands on the...

PT-2025-15461 · Aruba · Aos-8 Instant +1

Name of the Vulnerable Software and Affected Versions: AOS-8 Instant versions prior to the fixed version AOS-10 AP versions prior to the fixed version Description: A vulnerability in the file creation process on the command line interface could allow an authenticated remote attacker to perform...

CVE-2025-27078: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating system while using the CLI. Successful exploitation could lead to complete system compromise...