Loading vulnerability…
CVE-2026-23813 is a critical authentication bypass vulnerability in the web-based management interface of HPE Aruba Networking AOS-CX switches. The flaw allows a remote, unauthenticated attacker to circumvent existing authentication controls exposed by the management interface. In some cases, successful exploitation can also trigger an administrator password reset, enabling takeover of the device management plane. Reported affected release trains include AOS-CX 10.17.0001 and earlier, 10.16.1020 and earlier, 10.13.1160 and earlier, and 10.10.1170 and earlier. The vulnerability is network-reachable, requires no prior authentication or user interaction, and has been described with a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
Repository contains a small Python proof-of-concept suite for CVE-2026-23813, an authentication bypass in HPE Aruba Networking AOS-CX caused by an overly permissive nginx regex for public login endpoints. Structure is straightforward: three Python scripts (`detect.py`, `bypass_demo.py`, `exploit.py`) plus defensive/detection documentation and patch/root-cause notes. `detect.py` is a non-destructive scanner that sends a single GET to `/rest/v1/system/users/loginpoc` and classifies the target as PATCHED if nginx returns 401, otherwise VULNERABLE because the request reached the backend. `bypass_demo.py` compares a normal request to `/rest/v1/system/users/admin` with a smuggled request to `/rest/v1/system/users/loginpoc` to illustrate the bypass mechanics. `exploit.py` is the main exploit: it requires a checkpoint name containing `login`, then POSTs to `/rest/v1/config/copy/running-config/<name>` to create a checkpoint and GETs `/rest/v1/fullconfigs/<name>` to retrieve the full running configuration, printing user password hashes. The exploit is network/web based, targets the HTTPS management API, and is operational rather than weaponized because it includes a working hardcoded exploitation chain but not a flexible framework. The repository also includes `detection/suricata.rules` and `detection/nginx-access.md` for identifying exploit attempts, and `docs/root-cause.md` / `docs/patch-diff.md` explaining that vulnerable nginx used `^/rest/(|v.*/)login`, allowing slash-containing version segments and trailing `login*` tokens to bypass authentication before proxying the raw URI to the backend.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical authentication bypass vulnerability in the web management interface of Aruba CX switches running AOS-CX that can allow an unauthenticated remote attacker to bypass authentication and, in some cases, reset the administrator password to gain full control of the system.
A critical authentication bypass in the Aruba AOS-CX web-based management interface that can allow an unauthenticated remote actor to circumvent authentication controls and, in some cases, reset the admin password.
An authentication bypass in the web-based management interface of HPE Aruba AOS-CX switches that may allow an unauthenticated remote actor to circumvent authentication controls and potentially reset the admin password.
An authentication bypass vulnerability in the web-based management interface of AOS-CX switches that may allow unauthenticated remote attackers to bypass authentication and potentially reset the admin password.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.