Hewlett Packard Enterprise (HPE) sounded the alarm after vulnerabilities were found in its Aruba operating system (OS), with experts calling out systemic enterprise failure to isolate management interfaces.

The most critical vulnerability affecting the cloud-native Aruba Networking AOS-CX operating system allows bad actors to reset admin passwords. The issue is tracked as CVE-2026-23813 with a critical severity score of 9.0.

Four other vulnerabilities in the same software were also highlighted by HPE with variations on the same numbering pattern, spanning CVE-2026-23814-17. These issues were mainly authenticated command injection exploits in the command line interface (CLI) of AOS-CX, along with a vulnerability (CVE-2026-23817) in the web-based management interface of AOS-CX switches allowing unauthenticated remote attackers to redirect users to an arbitrary URL.

For the other issues, HPE recommended a series of actions, beginning with restricting management interface access to a dedicated layer-two segment or virtual local area network (VLAN), isolating it from general traffic. Users were also advised to enforce strict later-three access controls to allow only trusted hosts, disabling HTTP(S) on switched virtual interfaces and routed ports where unnecessary. Finally, it was suggested to protect REST/HTTP-enabled interfaces with control plane access control lists exclusively for trusted clients, and enable detailed logging, accounting, and monitoring to promptly detect and respond to unauthorized access attempts.

In its advisory, HPE Aruba Networking reported it was not aware of any public discussion or exploit code targeting the vulnerabilities.

Gene Moody, field CTO at Action1, commented the flaw highlights a structural issue within enterprise environments in the failure to isolate management interfaces. As he explained, if the network management plane stays inside the same trust boundary as user systems, a single foothold for an attack can quickly turn into a lateral movement problem that affects the entire network environment.

"In many networks, the systems that manage infrastructure share the same network space as the endpoints they manage. That creates a very short path from a user level compromise to infrastructure control," Moody explained. "If an attacker lands on a workstation or server that sits on the same logical network as switch management interfaces, the environment effectively hands them a ladder upward if the infrastructure is also vulnerable. These are extremely high value targets as they allow for observation and control at a level far beyond what an single endpoint typically can.

"Management planes should be treated as a separate security domain," Moody added. "That means isolating them physically where possible, logically through dedicated VLANs or networks, and through strict endpoint level access controls. Access to device management interfaces should come from a very small set of hardened administrative systems, not from the general production network. When that separation exists, a compromised endpoint does not automatically translate into access to the systems that run the network itself."

The CTO highlighted an operational advantage to this model, as updates to infrastructure platforms like network switches, hypervisors, and storage systems, which often require broader maintenance windows, can instead be planned and executed independently of user systems.

"That separation reduces operational risk and gives teams more flexibility to address critical vulnerabilities without triggering widespread disruption," Moody noted. "The Aruba case is a good reminder that patching is only part of the story. Architecture still matters."