CVE-2026-23818 is a high severity (CVSS 8.8) open redirect in the login flow of the HPE Aruba Networking Private 5G Core On-Prem GUI. A crafted URL can send a user to a spoofed login page that captures credentials. HPE has published a security bulletin, HPESBNW05032, with the fixed release.
What's affected
The product is HPE Aruba Networking Private 5G Core On-Prem. The record does not give version numbers, and the fixed release is in HPE bulletin HPESBNW05032. Read it before you plan the upgrade.
How to check if you're exposed
Find the software version of your Private 5G Core On-Prem deployment in its management GUI or your deployment records, then compare it with the bulletin. If the GUI login page is reachable from user networks or the internet, your exposure is higher, because the attack needs a person to follow a crafted link.
What to do now
- Read HPE bulletin HPESBNW05032 and note the fixed release.
- Upgrade the on-prem deployment to that release.
- Limit who can reach the GUI to administrator networks.
- Remind administrators to check the address bar after clicking a link to the login page, and to use bookmarks.
- If you suspect someone entered credentials on a lookalike page, rotate them.
Why it matters
Open redirects look minor, but they borrow the trust of your real domain. The link starts on your real login page, so a quick glance looks fine, and the victim ends up entering credentials on a copy. The weakness is CWE-601, URL redirection to an untrusted site.
The fix class is simple: validate the redirect target against an allowlist of internal paths. The record does not list CVE-2026-23818 as known exploited.
Reading the severity score
The record gives a CVSS base score of 8.8, published 2026-04-07. In the vector, the attacker works over the network, needs no account, and the attack is low in complexity. User interaction is required. Impact on confidentiality is high, on integrity high and on availability high.
A base score describes the flaw in general, not your risk. Weigh it against how exposed your instance is and what it can reach. The Gold page for the CVE keeps the score, weakness and references together.
Quick check
Does this need a user to click something?
Yes. The CVSS vector marks user interaction as required, and the description says a crafted URL is used.
Sources
Last reviewed: 19 October 2026.
