CVE-2026-23811
Client Isolation Bypass in Network Switches Enables MitM Attack
Publication date: 2026-03-04
Last updated on: 2026-03-09
Assigner: Hewlett Packard Enterprise (HPE)
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| arubanetworks | arubaos | From 10.3.0.0 (inc) to 10.4.1.10 (inc) |
| arubanetworks | arubaos | From 10.5.0.0 (inc) to 10.7.2.2 (inc) |
| arubanetworks | arubaos | From 6.5.4.0 (inc) to 8.10.0.21 (inc) |
| arubanetworks | arubaos | From 8.11.0.0 (inc) to 8.12.0.6 (inc) |
| arubanetworks | arubaos | From 8.13.0.0 (inc) to 8.13.1.1 (inc) |
| arubanetworks | arubaos | 10.8.0.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-300 | The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the client isolation mechanism, which is designed to restrict communication between clients at Layer 2 (L2) of the network. An attacker can exploit this flaw to bypass these L2 communication restrictions and redirect traffic at Layer 3 (L3).
Furthermore, if the attacker combines this exploit with a port-stealing attack, they may be able to perform a bi-directional Machine-in-the-Middle (MitM) attack, intercepting and potentially manipulating network traffic between clients.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to bypass network policies that isolate clients from each other, potentially exposing your network traffic to interception or redirection.
If exploited in combination with a port-stealing attack, it could enable a bi-directional Machine-in-the-Middle (MitM) attack, allowing the attacker to intercept, monitor, or manipulate communications between devices on the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know