-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 HPE Aruba Networking Product Security Advisory ============================================== Advisory ID: HPESBNW05002 CVE: CVE-2026-23595, CVE-2026-23596, CVE-2026-23597, CVE-2026-23598 Publication Date: 2026-Feb-10 Status: Confirmed Severity: High Revision: 1 Title ===== Multiple Vulnerabilities in HPE Aruba Networking Private 5G Core Overview ======== HPE Aruba Networking has released a software update for the HPE Aruba Networking Private 5G Core Platform that addresses exposure of sensitive information to unauthorized actors. Affected Products ================= This vulnerability affects HPE Aruba Networking Private 5g In the following versions unless specifically noted otherwise in the details section: HPE Aruba Networking Private 5g: - 1.24.3.0 - 1.24.3.1 - 1.24.3.2 - 1.24.3.3 Unaffected Products: - 1.24.2.2 and below - 1.25.1.0 and above - Any other version not explicitly listed as affected. Details ======= Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation (CVE-2026-23595) --------------------------------------------------------------------- An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data. Internal References: VULN-200 Severity: High CVSSv3.1 Base Score: 8.8 CVSSv3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Discovery: This vulnerability was discovered by Communications Security Establishment, CSE Unauthenticated Improper Access Control in management API allows unauthorized service disruption (CVE-2026-23596) --------------------------------------------------------------------- A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability. Internal References: VULN-202 Severity: Medium CVSSv3.1 Base Score: 6.5 CVSSv3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Discovery: This vulnerability was discovered by Communications Security Establishment, CSE Unauthenticated Information Disclosure in application API allows sensitive system information exposure (CVE-2026-23597, CVE-2026-23598) --------------------------------------------------------------------- A vulnerability in the API error handling of a 5G Core server API could allow an unauthenticated remote attacker to obtain sensitive error information. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities. Internal References: VULN-201, VULN-199 Severity: Medium CVSSv3.1 Base Score: 6.5 CVSSv3.1 Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Discovery: This vulnerability was discovered by Communications Security Establishment, CSE Resolution ========== To resolve the vulnerabilities described above, it is recommended to upgrade the software to the following version: - HPE Aruba Networking Private 5G Core 1.25.1.0 and above The latest version of the product is available for download at https://myenterpriselicense.hpe.com/ HPE Aruba Networking does not evaluate or patch HPE Aruba Networking Private 5G Core Software versions that have reached their End of Support (EoS) milestone. For more information about HPE Aruba Networking Product Lifecycle and versioning policy, please visit: https://www.hpe.com/psnow/doc/4aa5-5978enw?jumpid=in_pdfviewer-psnow Workaround ========== None Exploitation and Public Discussion ================================== As of the release date of this advisory, HPE Networking is not aware of any active public exploitation or discussion of these vulnerabilities. Revision History ================ Revision 1 / 2026-02-10 / Initial release HPE Aruba Networking SIRT Security Procedures ============================== Complete information on reporting security vulnerabilities in HPE Aruba Networking products and obtaining assistance with security incidents is available at: https://www.hpe.com/support/security-response-policy For reporting *NEW* HPE Aruba Networking security issues, email can be sent to aruba-sirt(at)hpe.com. For sensitive information we encourage the use of PGP encryption. Our public keys can be found at: https://www.hpe.com/info/psrt-pgp-key (c) Copyright 2026 by Hewlett Packard Enterprise Development LP. This advisory may be redistributed freely after the release date given at the top of the text, provided that the redistributed copies are complete and unmodified, including all data and version information -----BEGIN PGP SIGNATURE----- iQHLBAEBCAA1FiEEMErWmuZGsYOCo0+xpjMm7I0cE64FAmmGDxEXHHNlY3VyaXR5 LWFsZXJ0QGhwZS5jb20ACgkQpjMm7I0cE64m3Qv9E2xf595uOqI0zINgVY6+kipN xjWVRVSJRANm4sQsF4gFsQ/r4CeWIm9mPbh6hBwN7FAMs5pSUQTaGRK8O68hxJiq Mvx6I68ueuXs4tMnf2rVjJy82PtXIFTJkb1lHJ+0FurCovKYYwdnUXRWXl5TZQjy rJhFGA/YQY2T50QZUJlGdCDx2LtR0Xj4KnjJOTDT9PwB6oraYjA7wU1QYBfqxclg QFHqCfGlODj4AOpSZPMP43PUKfHgsKxgHEQca9Ooam5EarGKm+nXCQtQjTLk7Fvp TLuMGjOl7Iu7LeB9dL6nTB896tESZogL9PiCjRG5QNw3aGs1rJ7mM75/dVFPf5VS JX226i/gkd9mJmQbnBS9J7AH9POYKVEOo13zseDCmCK9C+QGs6QRsbi+PdllGYFD FKiqMa0jx9Q0GuA3AP9IBw129DWSafJff+PrjKcDyzddU5CEUojAXSIvm3X2oyCY Nzj6AmmhmJOM1RXVIFh2mKHVis7BFD43hKk+z8Zm =U99Z -----END PGP SIGNATURE-----