CVE-2026-23813 is a critical authentication bypass (CVSS 9.8) in the web-based management interface of HPE Aruba AOS-CX switches. HPE says an unauthenticated remote actor could get around authentication, and in some cases reset the admin password. Apply the firmware update from HPE security bulletin HPESBNW05027 and restrict who can reach the interface.
What's affected
The record lists several HPE Aruba CX models, including the CX 10000 series (for example part numbers R8P13A, R8P14A and S0F98A), the CX 10040 series and the CX 4100i. The NVD entry lists eight product entries in total, so do not assume your model is safe because it is not named here.
The record does not state fixed firmware versions. They are in HPE bulletin HPESBNW05027, which is a support portal page. Read it for the exact AOS-CX releases for your platform.
How to check if you're exposed
Your exposure depends on two things: the firmware on the switch and whether the web management interface can be reached by anyone you do not trust.
On the switch, show the running software version and the management services that are enabled:
show version
show https-server
Compare the version against the table in the HPE bulletin. Then check whether the management VRF or any routed interface exposes HTTPS to networks wider than your admin network.
What to do now
- Open HPE bulletin HPESBNW05027 and find the fixed AOS-CX release for your switch family.
- Schedule the firmware upgrade. Treat it as urgent for switches whose web interface is reachable beyond a dedicated admin network.
- Until you patch, limit access to the web interface to a management network or jump host, or disable the web interface if you do not use it.
- Check admin accounts and recent configuration changes on exposed switches. The vendor notes a password reset is possible in some cases.
- Rotate admin credentials after the upgrade.
Why it matters
The weakness class is CWE-287, improper authentication. A management plane that can be reached without proving identity gives control of the switch, and a switch sits in the middle of your traffic.
The record does not flag this CVE as known exploited (it is not in CISA KEV at the time of the record). That does not lower the urgency of fixing an unauthenticated, network-reachable flaw with a 9.8 score.
Reading the severity score
The record gives a CVSS base score of 9.8, published 2026-03-11. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is not needed. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Hardening beyond the patch
Network device management planes deserve their own rules. Put switch management on a dedicated VRF or out-of-band network, allow it only from a small set of admin hosts, and prefer SSH and the REST API over a browser interface where your tooling allows. Back up switch configurations before and after the upgrade, and store them off the device so you can spot unexpected changes later. Send switch logs to a central system so that password reset or login events are visible to someone other than the switch.
Quick check
Do I need to be logged in for this attack?
No. HPE describes it as exploitable by an unauthenticated remote actor, which is why the score is 9.8.
Is there a workaround if I cannot upgrade today?
The record does not list one. Reducing network reachability of the web interface is a sensible stopgap, but check the HPE bulletin for its own guidance.
Sources
Last reviewed: 19 October 2026.
