CVE-2026-23816
Received Received - Intake

Command Injection in AOS-CX Switch CLI Enables Remote Code Execution

Publication date: 2026-03-11

Last updated on: 2026-03-11

Assigner: Hewlett Packard Enterprise (HPE)

Description
A vulnerability in the command line interface of AOS-CX Switches could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-03-11
Last Modified
2026-03-11
Generated
2026-07-26
AI Q&A
2026-03-11
EPSS Evaluated
2026-07-25
NVD
CVE-2026-23816
EUVD
EUVD-2026-11077

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
hpe aos-cx_switches *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the command line interface of AOS-CX Switches. It allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system.

Detection Guidance

I don't know

Impact Analysis

An attacker exploiting this vulnerability could execute arbitrary commands on the switch's operating system, potentially leading to full compromise of the device.

  • Confidentiality impact: High
  • Integrity impact: High
  • Availability impact: High
Compliance Impact

I don't know

Mitigation Strategies

I don't know

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23816. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart