CVE-2026-23595: Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation
An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23595?
CVE-2026-23595 is considered a critical vulnerability due to its potential for privilege escalation and unauthorized administrative access.
How do I fix CVE-2026-23595?
To fix CVE-2026-23595, update the affected HPE Aruba Networking Private 5G Core software to version 1.24.3.4 or later.
What types of attacks can exploit CVE-2026-23595?
CVE-2026-23595 can be exploited by remote attackers to create unauthorized administrative accounts.
Which versions are affected by CVE-2026-23595?
CVE-2026-23595 affects HPE Aruba Networking Private 5G Core versions from 1.24.3.0 to 1.24.3.3.
Is authentication required to exploit CVE-2026-23595?
No, CVE-2026-23595 allows for authentication bypass, enabling exploitation without authentication.