CVE-2026-23808

low-risk

Published 2026-03-04

A vulnerability has been identified in a standardized wireless roaming protocol that could enable a malicious actor to install an attacker-controlled Group Temporal Key (GTK) on a client device. Successful exploitation of this vulnerability could allow a remote malicious actor to perform unauthorized frame injection, bypass client isolation, interfere with cross-client traffic, and compromise network segmentation, integrity, and confidentiality.

Do I need to act?

0.07% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

ADJACENT_NETWORK / LOW complexity

Affected Products (2)

Arubaos

Affected Vendors

Arubanetworks

References (1)

Vendor Advisory https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw05026en_us&docLocal...

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 7/34 · Low