CVE-2026-23601

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in the wireless encryption handling of Wi-Fi transmissions. A malicious actor can generate shared-key authenticated transmissions containing targeted payloads while impersonating the identity of a primary BSSID.Successful exploitation allows for the delivery of tampered data to specific endpoints, bypassing standard cryptographic separation.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-327

Affected software

VendorProductVersions
Hewlett Packard Enterprise (HPE)HPE Aruba Networking Wireless Operating System (AOS-10 & AOS-8)10.8.0.0; >= 10.7.0.0, <= 10.7.2.2; >= 10.4.0.0, <= 10.4.1.10; >= 8.13.0.0, <= 8.13.1.1; >= 8.12.0.0, <= 8.12.0.6; >= 8.10.0.0, <= 8.10.0.21

References

Timeline

Published
Mar 4, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-236033.1Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claimCVE-2026-236045.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workCVE-2026-236055.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation wCVE-2026-236065.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creaCVE-2026-236075.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interCVE-2026-236085.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoiCVE-2026-236095.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configurationCVE-2026-23618.0PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a temporary view based on a functCVE-2026-236105.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint.CVE-2026-236115.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page. An autCVE-2026-236125.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page.CVE-2026-236135.4GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the URI DNS Blocklist configuration page
CVE-2026-23601: Medium severity, CVSS 5.4 | Vulnix