Medium severity · published Feb 17, 2026
CVE-2026-23596
Unauthenticated Improper Access Control in management API allows unauthorized service disruption
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability in the management API of the affected product could allow an unauthenticated remote attacker to trigger service restarts. Successful exploitation could allow an attacker to disrupt services and negatively impact system availability.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 19% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HA
HPE Aruba Networking Private 5G Core · Hewlett Packard Enterprise (HPE)
1.24.3.0 through 1.24.3.4 · source: vendor
AN
Aruba Networking Private 5g Core · Hpe
1.24.3.0 through 1.24.3.3 · source: NVD
Affected product
HA
HPE Aruba Networking Private 5G Core
Hewlett Packard Enterprise (HPE)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23596
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23596
Patch
https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05002en_us&docLocale=en_US
More from HPE Aruba Networking Private 5G Core
8.8
CVE-2026-23595
Unauthenticated Authentication Bypass in application API allows unauthorized administrative account creation
7.7
CVE-2025-37100
Exposure of Sensitive Information to an Unauthorized User in HPE Aruba Networking Private 5G Core
6.5
CVE-2026-23598
Unauthenticated Information Disclosure in application API allows sensitive system information exposure
6.5
CVE-2026-23597
Unauthenticated Information Disclosure in application API allows sensitive system information exposure