CVE-2026-23808 Client Isolation Bypass via GTK Manipulation
Remote attackers can bypass client isolation and inject frames by installing a malicious Group Temporal Key, compromising network segmentation and confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-23808?
CVE-2026-23808 is a medium-severity vulnerability in Arubanetworks Arubaos, published on 4 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.
Weakness: CWE-94
Which versions are affected by CVE-2026-23808?
It affects 1 product.
Products include Arubanetworks Arubaos.
How do I fix CVE-2026-23808?
No fix has been published for CVE-2026-23808 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-23808 being exploited?
There is no known exploitation of CVE-2026-23808 in the wild and no public exploit code.
Other vulnerabilities in Arubanetworks Arubaos
- CVE-2024-42393 Memory corruption in Hpe Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42394 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-42395 Memory corruption in HPE Aruba Networking InstantOS and Aruba Access Points running ArubaOS 10
- CVE-2024-31466 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
- CVE-2024-31467 Unauthenticated Buffer Overflow Vulnerabilities in CLI Service Accessed by the PAPI Protocol
Sources
Also known as GHSA-3xgp-5q28-4f22.