CVE-2026-23597 Unauthenticated Information Disclosure in application API allows sensitive system information exposure

Medium 6.5 Published 17 Feb 2026 Updated 18 Feb 2026

Unauthenticated attackers can access sensitive system information via API error handling, exposing user accounts and configuration details.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-23597?

CVE-2026-23597 is a medium-severity vulnerability in Hewlett Packard Enterprise (HPE) HPE Aruba Networking Private 5G Core, published on 17 Feb 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Vulnerabilities in the API error handling of an HPE Aruba Networking 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could allow an attacker to access details such as user accounts, roles, and system configuration, as well as to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities.

Weakness: CWE-200

Which versions are affected by CVE-2026-23597?

It affects 1 product.

Products include Hpe Aruba Networking Private 5g Core.

How do I fix CVE-2026-23597?

No fix has been published for CVE-2026-23597 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-23597 being exploited?

There is no known exploitation of CVE-2026-23597 in the wild and no public exploit code.

Sources

Also known as GHSA-5fc6-h8m7-2wfc.