CVE-2026-23819: Error in SSID Processing allows Stored XSS in Web Management Interface
A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remote attacker to execute arbitrary JavaScript code in a victim's browser within the same local network. Successful exploitation could allow an attacker to compromise user data and potentially manipulate device configuration settings.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23819?
CVE-2026-23819 has a critical severity level due to the potential for unauthenticated remote attackers to exploit the vulnerability.
How do I fix CVE-2026-23819?
To mitigate CVE-2026-23819, ensure that you upgrade the affected Access Points running AOS-10 and AOS-8 Instant to the latest patched versions provided by the vendor.
What types of attacks can be performed with CVE-2026-23819?
CVE-2026-23819 allows attackers to perform Stored Cross-Site Scripting (XSS), executing arbitrary JavaScript code in victim browsers.
Which products are affected by CVE-2026-23819?
CVE-2026-23819 affects Aruba AOS-10 and AOS-8 Instant Access Points that utilize the web-based management interface.
Can CVE-2026-23819 be exploited remotely?
Yes, CVE-2026-23819 can be exploited remotely by an unauthenticated attacker, which poses a significant security risk.