CVE-2026-23820: Aruba AOS-8/10 AP CLI Vulnerability Allows Arbitrary Command Execution

The National Vulnerability Database has detailed CVE-2026-23820, a high-severity vulnerability (CVSS 7.2) impacting the command-line interface of Aruba Access Points running AOS-10 and AOS-8 Instant. This flaw permits an authenticated remote attacker to bypass the restricted shell environment and execute arbitrary system commands on the underlying operating system.

This isn’t just a shell escape; it’s a full system compromise waiting to happen. An attacker who gains authenticated access to the CLI – potentially through compromised credentials or an exposed management interface – can transition from a limited shell to full OS command execution. This level of access means total control over the Access Point, allowing for data exfiltration, network pivot points, or persistent backdoor installation. The “authenticated remote attacker” prerequisite doesn’t make this a trivial exploit, but it certainly isn’t a showstopper for a determined adversary.

Defenders need to treat their network infrastructure management interfaces with extreme prejudice. This vulnerability underscores the critical importance of robust access controls, strong authentication, and strict network segmentation for management planes. Assuming network devices are inherently secure once authenticated is a dangerous fallacy. Any system that allows command execution is a target, and a restricted shell is often just a speed bump for a skilled attacker.