CVE-2026-23808
A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.
- Score
- CVSS 3.1 8.1 High
- Status
- Analyzed - security-alert@hpe.com
- Published
- 2026-03-04
- Last modified
- 2026-04-01
- Weaknesses
- CWE-94
Affected products
- Arubaos (Arubanetworks)
- Hpe Aruba Networking Wireless Operating System Aos-10 Aos-8 (Hewlett Packard Enterprise Hpe)
References
- https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US
