CVE-2026-23809

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

A technique has been identified that adapts a known port-stealing method to Wi-Fi environments that use multiple BSSIDs. By leveraging the relationship between BSSIDs and their associated virtual ports, an attacker could potentially bypass inter-BSSID isolation controls. Successful exploitation may enable an attacker to redirect and intercept the victim's network traffic, potentially resulting in eavesdropping, session hijacking, or denial of service.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Mar 4, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-23816.5The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability cCVE-2026-238103.1A vulnerability in the packet processing logic may allow an authenticated attacker to craft and transmit a malicious Wi-Fi frame that causesCVE-2026-238113.1A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients anCVE-2026-238124.2A vulnerability has been identified where an attacker connecting to an access point as a standard wired or wireless client can impersonate aCVE-2026-238139.8A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticatedCVE-2026-238148.8A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to injecCVE-2026-238157.2A vulnerability in a custom binary used in AOS-CX Switches' CLI could allow an authenticated remote attacker with high privileges to performCVE-2026-238168.8A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands CVE-2026-238176.1A vulnerability in the web-based management interface of AOS-CX Switches could allow an unauthenticated remote attacker to redirect users toCVE-2026-238189.6A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow aCVE-2026-238198.8A vulnerability in the web-based management interface of Access Points running AOS-10 and AOS-8 Instant could allow an unauthenticated remotCVE-2026-23826.4The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw_fs_get_file
CVE-2026-23809: High severity, CVSS 7.6 | Vulnix