CVE-2026-23811 MEDIUM

CVE-2026-23811: Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation

Vendor Hewlett Packard Enterprise (Hpe)
Product HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)
Published March 4, 2026
Last update April 1, 2026

CVSS base score

4.3/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.

Key dates

02Disclosure timeline

March 4, 2026 CVE published
April 1, 2026 Record updated