VDB
CVE-2026-95717
CVE-2026-95717
PUBLISHED
CVSS 5.5 MEDIUM
Reported by hpe · Published October 22, 2026
A stored cross-site scripting (XSS) vulnerability exists in the web-based management interface of AOS that could allow an authenticated remote attacker with high privileges to inject malicious scripts. Successful exploitation could allow an attacker to execute arbitrary script code in the context of another authenticated user's browser session.
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hewlett Packard Enterprise (HPE) | ArubaOS (AOS) | 10.8.0.0, 10.7.0.0, 10.4.0.0 |
| Hewlett Packard Enterprise (HPE) | Unknown product | 10.8.0.0, 10.6.0.0, 10.3.0.0 |
| Hewlett Packard Enterprise (HPE) | ArubaOS (AOS) | 10.8.0.0, 10.7.0.0, 10.4.0.0 |
Timeline
- Oct 22, 2026 CVE Published
- Oct 23, 2026 EPSS Score
- Oct 23, 2026 Coalition ESS Score
- Oct 23, 2026 CVE Updated
- Oct 24, 2026 EPSS Score
- Oct 25, 2026 EPSS Score