CVE-2026-23827 Unauthenticated Remote Code Execution via Heap Buffer Overflow in Network Management Service

High 7.5 Published 12 May 2026 Updated 13 May 2026

Unauthenticated remote attackers can execute arbitrary code or cause denial of service via a heap buffer overflow in the network management service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-23827?

CVE-2026-23827 is a high-severity memory corruption vulnerability in Arubanetworks Arubaos, published on 12 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A heap-based buffer overflow vulnerability exists in a Network management service of AOS-8 and AOS-10 that could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could allow an unauthenticated attacker to execute arbitrary code as a privileged user on the underlying operating system, potentially leading to a system compromise. Exploitation may also result in a denial-of-service (DoS) condition affecting the impacted system process.

Weakness: CWE-122

Which versions are affected by CVE-2026-23827?

It affects 2 products.

Products include Arubanetworks Arubaos, Arubanetworks Sd-Wan.

How do I fix CVE-2026-23827?

No fix has been published for CVE-2026-23827 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-23827 being exploited?

There is no known exploitation of CVE-2026-23827 in the wild and no public exploit code.

All Arubanetworks Arubaos vulnerabilities

Sources

Also known as GHSA-jr3f-xhmv-xm9q.