Critical flaw in HPE Aruba CX switches lets attackers seize admin control without credentials

A critical vulnerability in HPE Aruba CX switches allows remote attackers to gain administrative control without credentials, posing a significant threat to enterprise networks. The flaw, identified as CVE-2026-23813, has a severity score of 9.8 out of 10 on the CVSSv3.1 scale and can be exploited without authentication, privileges, or user interaction¹. Located in the web-based management interface of AOS-CX switches, this vulnerability enables attackers to seize control of network switches, potentially leading to unauthorized access and malicious activities. HPE Aruba Networking has released patches for this and four other vulnerabilities in its AOS-CX switch software. The disclosure of CVE-2026-23813 expands the active attack surface, making it essential for organizations to prioritize patching based on their exposure and exploitation evidence. This vulnerability matters to practitioners as it highlights the need for prompt action to prevent potential attacks and protect network infrastructure.