CVE-2026-23811
Unauthorized Bi-Directional Traffic Interception via L2/L3 Manipulation
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.3EPSS 0.2%KEV nãoPoC —Patch —
Lifecycle
Mar 04, 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability in the client isolation mechanism may allow an attacker to bypass Layer 2 (L2) communication restrictions between clients and redirect traffic at Layer 3 (L3). In addition to bypassing policy enforcement, successful exploitation - when combined with a port-stealing attack - may enable a bi-directional Machine-in-the-Middle (MitM) attack.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Hewlett Packard Enterprise (HPE) · HPE Aruba Networking Wireless Operating Systems (AOS-8 & AOS-10)Want to know if your infrastructure is exposed to this?
Talk to TrueHacking →