Loading story…
HPE Aruba Networking Private 5G Core shipped fixes for multiple vulnerabilities affecting versions 1.24.3.0 through 1.24.3.3 that could allow remote, unauthenticated attackers to compromise private 5G core management functions. The most severe issue, CVE-2026-23595 (CVSS 8.8), is an authentication bypass in the application API that can allow an attacker to create a new administrative account without credentials, enabling full administrative control, configuration changes, and potential access to or manipulation of sensitive data within the private 5G core environment.
Additional flaws reported alongside the auth bypass include an unauthenticated management-API condition that can trigger service restarts (CVE-2026-23596), creating a denial-of-service risk, and information disclosure issues (CVE-2026-23597 and CVE-2026-23598) that can expose details such as user accounts and roles. The Canadian Centre for Cyber Security also issued an alert referencing HPE’s bulletin (HPESBNW05002 rev.1) and urged organizations running affected Private 5G Core versions to apply vendor updates; other Canadian Centre advisories in the same period (Apple, Chrome, Drupal, Intel, Fortinet, Siemens, Dell, CISA ICS, IBM, Red Hat, and a broader HPE roundup) are separate patch notifications and not specific to the Aruba Private 5G Core issue.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The Canadian Centre for Cyber Security issued alert AV26-110 referencing HPE's advisory and directed users and administrators to review the bulletin and apply the necessary updates. The notice highlighted the affected versions and pointed readers to HPE's Security Bulletin Library for more details.
On February 10, 2026, HPE published security bulletin HPESBNW05002 rev.1 covering multiple vulnerabilities in HPE Aruba Networking Private 5G Core, including CVE-2026-23595 through CVE-2026-23598. HPE released version 1.25.1.0 to remediate the flaws and advised customers running 1.24.3.x to upgrade.
The Communications Security Establishment discovered four vulnerabilities in HPE Aruba Networking Private 5G Core that could enable authentication bypass, administrative takeover, denial of service, and information disclosure. The issues affected versions 1.24.3.0 through 1.24.3.3.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett Packard Enterprise (HPE) released security updates for multiple products, including **HPE Aruba Networking AOS-CX** and **HPE Telco Intelligent Assurance**, and the Canadian Centre for Cyber Security amplified the guidance to review HPE advisories and apply the required patches. The Aruba AOS-CX updates address multiple issues in the switch OS, with reporting highlighting a **critical authentication bypass** in the web management interface that can allow an **unauthenticated remote attacker** to bypass authentication controls and, in some cases, **reset the admin password** (tracked as `CVE-2026-23813`). HPE stated it was not aware of public exploit code or active exploitation at the time of advisory publication. For **HPE Telco Intelligent Assurance**, HPE disclosed an **arbitrary code execution** risk tied to its deployment of **Apache Avro** when generating specific records from **untrusted Avro schemas** (`CVE-2025-33042`, CVSS 3.1 base score **7.3**). HPE indicated the affected Avro Java SDK versions include all versions through **1.11.4** and **1.12.0**, with fixes available in **1.11.5** or **1.12.1**; HPE Telco Intelligent Assurance remediation is provided via upgrading to **FAS 4.2.14** / **PDO 4.2.14**. Where immediate patching is not possible for Aruba AOS-CX, mitigations include restricting management-plane access (e.g., dedicated management VLAN/segment), enforcing L3 policies and control-plane ACLs, disabling unnecessary HTTP(S) exposure on SVIs/routed ports, and increasing logging/monitoring of management interface activity.
Jun 29, 2026
Hewlett Packard Enterprise released security updates for multiple vulnerabilities in **HPE Aruba Networking** access points running **Instant AOS-8** and **AOS-10**, including two critical flaws that can lead to remote code execution. The most severe issues, tracked as `CVE-2024-42509` and `CVE-2024-47460`, affect the CLI service and can be exploited by an unauthenticated attacker by sending specially crafted packets to **UDP port 8211**, where the **PAPI** management protocol listens, enabling command injection and code execution on vulnerable devices. HPE also addressed four additional high-severity vulnerabilities — `CVE-2024-47461`, `CVE-2024-47462`, `CVE-2024-47463`, and `CVE-2024-47464` — that could allow a remote authenticated attacker to execute code or access sensitive information. HPE advised organizations to upgrade to fixed **AOS-10** and **Instant AOS-8** releases immediately, restrict exposure of management interfaces if patching cannot be completed at once, and replace Aruba products that have reached end of support.
Jul 24, 2026
HPE issued security advisories covering multiple vulnerabilities in **HPE Telco Network Function Virtualization Orchestrator** and **HPE Aruba Networking ArubaOS-CX Switches**, including critical issues affecting Telco NFV Orchestrator `7.6.0` and earlier. The ArubaOS-CX advisories affect several software branches, including `10.16.1000` and earlier, `10.15.0005` and earlier, and `10.13.1080` and earlier, prompting guidance for customers to review vendor bulletins and deploy updates. The disclosures also include bulletin **`HPESBNW05062 rev.1`**, which addresses the status of the **OpenSSH Keystroke Obfuscation Bypass** vulnerability, tracked as **`CVE-2024-39894`**, on ArubaOS-CX. Canada’s Centre for Cyber Security echoed the HPE notice and urged administrators to consult the linked advisories and apply the recommended remediations to affected networking and orchestration platforms.
Jun 29, 2026