CVE-2026-23811

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23811
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*
OR cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9106:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9114:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-634:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-635:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-654:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-655:-:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en el mecanismo de aislamiento de clientes puede permitir a un atacante eludir las restricciones de comunicación de Capa 2 (L2) entre clientes y redirigir el tráfico en Capa 3 (L3). Además de eludir la aplicación de políticas, la explotación exitosa - cuando se combina con un ataque de robo de puerto - puede habilitar un ataque de Máquina en el Medio (MitM) bidireccional.

09 Mar 2026, 19:19

Type Values Removed Values Added
First Time Arubanetworks 7280
Arubanetworks 9012
Arubanetworks arubaos
Arubanetworks
Arubanetworks 9106
Arubanetworks ap-655
Arubanetworks 7030
Arubanetworks 7210
Arubanetworks 7010
Arubanetworks 9114
Arubanetworks 7205
Arubanetworks ap-654
Arubanetworks 7220
Arubanetworks ap-634
Arubanetworks 7240xm
Arubanetworks 9004
Arubanetworks 9004-lte
Arubanetworks 9240
Arubanetworks ap-635
References () https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US - () https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocale=en_US - Vendor Advisory
CPE cpe:2.3:h:arubanetworks:ap-635:-:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:10.8.0.0:*:*:*:*:*:*:*
cpe:2.3:o:arubanetworks:arubaos:*:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7210:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9004-lte:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9106:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7010:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9004:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7240xm:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9012:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7280:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-654:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7205:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9114:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-655:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:9240:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:ap-634:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7030:-:*:*:*:*:*:*:*
cpe:2.3:h:arubanetworks:7220:-:*:*:*:*:*:*:*

04 Mar 2026, 18:16

Type Values Removed Values Added
CWE CWE-300

04 Mar 2026, 17:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-04 17:16

Updated : 2026-06-17 10:22

NVD link : CVE-2026-23811

Mitre link : CVE-2026-23811

CVE.ORG link : CVE-2026-23811

JSON object : View

Products Affected

arubanetworks

  • 9114
  • 7280
  • 7240xm
  • 9004-lte
  • 9106
  • 7220
  • 9012
  • ap-635
  • 7030
  • 7210
  • 9240
  • ap-654
  • ap-655
  • 7205
  • 9004
  • ap-634
  • arubaos
  • 7010
CWE
CWE-300

Channel Accessible by Non-Endpoint