AOS-10/AOS-8 Instant AP Vulnerability Allows Remote Code Execution

The National Vulnerability Database has disclosed CVE-2026-23819, a high-severity vulnerability (CVSS 8.8) affecting Access Points running AOS-10 and AOS-8 Instant. This flaw resides in the web-based management interface, allowing an unauthenticated remote attacker within the same local network to inject and execute arbitrary JavaScript code in a victim’s browser. This is a classic cross-site scripting (XSS) scenario, but its network-adjacent nature and impact are significant.

Successful exploitation of this vulnerability grants attackers the ability to compromise user data and potentially manipulate device configuration settings. The attack vector is ‘Adjacent’, meaning the attacker must be on the same local network segment, but crucially, no prior authentication is required. The user interaction requirement (‘UI:R’) means the victim must visit a malicious link or be tricked into interacting with the compromised interface, which is a common tactic in targeted attacks.

This isn’t just about stealing session cookies. The ability to manipulate device configuration via arbitrary JavaScript execution can lead to full device compromise, network pivots, or persistent backdoors. Defenders need to recognize the gravity of unauthenticated access to management interfaces, even if it’s ‘only’ within the LAN. This is how lateral movement begins.