Aruba Security Updates – 12 February 2026

The addressed vulnerabilities could allow the attacker to perform denial of service attacks, bypass security restrictions, obtain sensitive information, conduct crosssite scripting attacks, manipulate files, or execute arbitrary code and gain access to the affected product.

Sample of the addressed vulnerabilities:

1. Unauthenticated Authentication Bypass in Application API Vulnerability (CVE-2026-23595):

• CVSS: 8.8
• Attack Vector: Adjacent
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Gain Access

2. Unauthenticated Arbitrary File Deletion Vulnerability in AOS-8 Operating System Vulnerability (CVE-2025-37168):

• CVSS: 8.2
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: File Manipulation

Sample of the affected products:

• EdgeConnect SD-WAN Orchestrator 9.6.x: 9.6.0.
• HPE Aruba Networking Private 5G Core: 1.24.3.0.
• HPE Aruba Networking VIA client for Linux: 4.7.5 and below.
• AOS-10.7.x.x: 10.7.2.1 and below.