What’s Vulnerable › Vulnerabilities
CVE-2026-23818: Open Redirect Vulnerability in HPE Aruba Networking Private 5G Core On-Prem
- Severity: critical (CVSS 9.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-04-07 · updated 2026-10-26
- Weakness: CWE-601
Description
A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulnerability in the login flow using a crafted URL. Successful exploitation may redirect an authenticated user to an attacker-controlled server hosting a spoofed login page prompting the unsuspecting victim to give away their credentials, which could then be captured by the attacker, before being redirected back to the legitimate login page.
Affected products
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Private 5G Core: before 1.25.3.1 — fixed in 1.25.3.1
How to fix
Upgrade to a fixed version: Hewlett Packard Enterprise (HPE) HPE Aruba Networking Private 5G Core 1.25.3.1. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23818 or the next vulnerability affects your stack