CVE-2016-8526

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-08-06 · updated 2026-06-17
Weakness: CWE-611

Description

Aruba Airwave all versions up to, but not including, 8.2.3.1 is vulnerable to an XML external entities (XXE). XXEs are a way to permit XML parsers to access storage that exist on external systems. If an unprivileged user is permitted to control the contents of XML files, XXE can be used as an attack vector. Because the XML parser has access to the local filesystem and runs with the permissions of the web server, it can access any file that is readable by the web server and copy it to an external system of the attacker's choosing. This could include files that contain passwords, which could then lead to privilege escalation.

Affected products

Hewlett Packard Enterprise Aruba AirWave: before 8.2.3.1 — fixed in 8.2.3.1

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise Aruba AirWave 8.2.3.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2016-8526 or the next vulnerability affects your stack