Loading story…
Hewlett Packard Enterprise (HPE) AutoPass License Server (APLS) was disclosed to contain a remote authentication bypass vulnerability tracked as CVE-2026-23600 (ZDI-CAN-27634) with a CVSS 7.3 rating. The flaw is in the product’s web service (default TCP port 5814) and stems from incorrect authentication checks before granting access to functionality, allowing unauthenticated remote attackers to bypass login controls and access protected capabilities.
HPE issued an update to remediate the issue (security bulletin HPESBGN05003), and the Canadian Centre for Cyber Security highlighted that APLS versions prior to 9.19 are affected and urged administrators to apply the vendor-provided fixes. The Zero Day Initiative advisory notes the vulnerability was reported to HPE in September 2025 and publicly released via coordinated disclosure in March 2026, with credit attributed to an anonymous reporter.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-03-04, a GitHub pull request was opened in the projectdiscovery/nuclei-templates repository to add a Nuclei template for detecting exposed HPE AutoPass License Server panels associated with CVE-2026-23600. The submission was reviewed and flagged for syntax, regex, metadata, and false-positive issues, indicating early community detection work around the vulnerability.
On 2026-03-03, the Zero Day Initiative released advisory ZDI-26-134 for CVE-2026-23600, describing an authentication bypass in the APLS web service on TCP port 5814 caused by improper authentication checks. ZDI said exploitation requires no prior authentication and noted that HPE had already released an update to remediate the flaw.
On 2026-02-27, HPE published security bulletin HPESBGN05003 rev.1 for a remote authentication bypass vulnerability in HPE AutoPass License Server, tracked as CVE-2026-23600. The issue affects APLS versions prior to 9.19, and HPE advised customers to upgrade to a fixed release.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcegithub.com
Open sourcezerodayinitiative.com
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Hewlett Packard Enterprise released **ALE 5.1.0.0** to fix ten vulnerabilities in HPE Networking Analytics and Location Engine (ALE) 5.0.0.0 and earlier. The most severe, `CVE-2026-76708` (hard-coded default credentials) and `CVE-2026-76709` (privileged arbitrary file write), are remotely exploitable without authentication, carry CVSS 9.8 scores, and could enable full appliance compromise. The ALE advisory also addresses information disclosure, data injection, root-level filesystem and command-execution exposure, man-in-the-middle risk, denial of service, and password-hash disclosure. HPE reported no known public exploit code or active exploitation, but administrators should upgrade immediately and restrict or segment access to ALE management interfaces; a related HPE advisory also identifies a remote denial-of-service vulnerability in Telco Service Orchestrator 5.6.0 and earlier.
Sep 25, 2026
Hewlett Packard Enterprise (HPE) released security updates for multiple products, including **HPE Aruba Networking AOS-CX** and **HPE Telco Intelligent Assurance**, and the Canadian Centre for Cyber Security amplified the guidance to review HPE advisories and apply the required patches. The Aruba AOS-CX updates address multiple issues in the switch OS, with reporting highlighting a **critical authentication bypass** in the web management interface that can allow an **unauthenticated remote attacker** to bypass authentication controls and, in some cases, **reset the admin password** (tracked as `CVE-2026-23813`). HPE stated it was not aware of public exploit code or active exploitation at the time of advisory publication. For **HPE Telco Intelligent Assurance**, HPE disclosed an **arbitrary code execution** risk tied to its deployment of **Apache Avro** when generating specific records from **untrusted Avro schemas** (`CVE-2025-33042`, CVSS 3.1 base score **7.3**). HPE indicated the affected Avro Java SDK versions include all versions through **1.11.4** and **1.12.0**, with fixes available in **1.11.5** or **1.12.1**; HPE Telco Intelligent Assurance remediation is provided via upgrading to **FAS 4.2.14** / **PDO 4.2.14**. Where immediate patching is not possible for Aruba AOS-CX, mitigations include restricting management-plane access (e.g., dedicated management VLAN/segment), enforcing L3 policies and control-plane ACLs, disabling unnecessary HTTP(S) exposure on SVIs/routed ports, and increasing logging/monitoring of management interface activity.
Jun 29, 2026
**HPE Aruba Networking Private 5G Core** shipped fixes for multiple vulnerabilities affecting versions **1.24.3.0 through 1.24.3.3** that could allow remote, unauthenticated attackers to compromise private 5G core management functions. The most severe issue, **CVE-2026-23595** (CVSS **8.8**), is an **authentication bypass in the application API** that can allow an attacker to **create a new administrative account without credentials**, enabling full administrative control, configuration changes, and potential access to or manipulation of sensitive data within the private 5G core environment. Additional flaws reported alongside the auth bypass include an unauthenticated management-API condition that can **trigger service restarts** (**CVE-2026-23596**), creating a denial-of-service risk, and **information disclosure** issues (**CVE-2026-23597** and **CVE-2026-23598**) that can expose details such as user accounts and roles. The Canadian Centre for Cyber Security also issued an alert referencing HPE’s bulletin (**HPESBNW05002 rev.1**) and urged organizations running affected Private 5G Core versions to apply vendor updates; other Canadian Centre advisories in the same period (Apple, Chrome, Drupal, Intel, Fortinet, Siemens, Dell, CISA ICS, IBM, Red Hat, and a broader HPE roundup) are separate patch notifications and not specific to the Aruba Private 5G Core issue.
Jun 29, 2026